- So in this segment,
we're gonna take a closer look at log files.
I love logs, I said that in the lesson
I'm gonna say it again here in this lab.
I absolutely love logs,
because logs are just a wealth of information
that mining and monitoring the information generated
by the logs of your hosts connectivity
and digital devices really just offers you
such great information to help protect your organization.
Now our log data offers clues
about activities that may result
in unexpected and possibly harmful consequences.
Now, most organizations use their logs
to be looking at at-risk events.
At-risk events include unauthorized access,
malware data leakage, and suspicious activity.
But I would suggest to you
that you should also be using your logs
for oversight and for security related
operational activities.
So let's talk about oversight.
Oversight includes reporting on administrative activity
user management, policy changes,
remote desktop sessions, configuration changes,
and unexpected access.
Now all of that activity might be legitimate,
but it also might be questionable.
And then we have security related operational activities.
Now these are operational activities
which include things like reporting on patch installation,
software installation, service management,
reboots, bandwidth utilization,
DNS and DHCP traffic, which at first don't really sound
like they're security related, but they are right?
Knowing that a patch actually was installed
perhaps there's something
in the log that says patch installed
but you have to reboot for it to take effect.
That's very important.
Software installation, should that software been installed?
Service management, who maybe is making changes
to some of the services on the device?
Why did the machine reboot?
Bandwidth utilization,
is that out of the ordinary and that any DNS
or DHCP traffic that's trying to be resolved?
So our log datas offer clues about all of this kind
of activity at risk, oversight and security related.
Let's look at a couple of different log extracts,
so I can give you some examples.
First up, we're gonna look at a firewall log.
So our first entry is about a download
and the question really is legitimate download
or a nefarious activity.
What we're seeing is a local host, 192.168.1.3
access URL 69.4.231.52,
and we can see that they actually did a download.
So they went out to a wire shark download,
and they downloaded Wireshark-win64-1.6.6.exe.
Now, that could be perfectly legitimate or not,
but don't you wanna know, right?
Wireshark is a packet capture application.
Is there a reason?
Who's at that address?
Who is at 192.168.1.3?
Was it a network admin who's going to do Wireshark
for some troubleshooting?
Or perhaps is it an insider who maybe is going to
do something not quite what we want them to do?
So being able to look at an entry like
this and say legitimate or nefarious, that's important.
Here's another firewall entry.
And our question this time is legitimate modification
or rogue action.
What we're looking at here is we've got a 40 gate firewall.
We can see that our admin or root user J Miles
has logged in from 10.104.1.103
and made a change to the IP four firewall policy
from the GUI.
Could be perfectly legitimate or not.
How would you know if it's legitimate?
Well, you could compare it against your change request.
There should be a change request for doing that
Firewall change again, could be just fine
or could be a rogue action, and we really wanna know that.
So this extract is from a Windows log,
and what we're seeing here is the success
of adding a new user Epires to the domain admin account.
Now, it was added by Gpontes,
Could be a legitimate ad,
you know, that we wanna add somebody
to our domain admins account,
or is this maybe infiltration or the start of an attack?
So important, right?
This is the domain admins group,
now the group that holds the keys to the kingdom.
So we see the success of a user being added,
we wanna question it.
Is this a legitimate ad or potentially infiltration?
And last, let's look at a question about data exfiltration.
Are we sending data up to the cloud appropriately
or is there a problem?
What we're looking at here is connection
to an an outside address,
which happens to be a a cloud service on 443.
So TLS, so it's all encrypted,
but we can see that a connection was made.
We can see that the duration was about a minute and a half,
and we can see the amount of data that would've been sent.
Now again, could be perfectly legitimate
sending data up to the cloud,
or it could be a sign of data exfiltration.
So in all of these cases,
what we were looking at was successful actions
could be legit or not,
but we wanna be able to have this knowledge
use this information to really assess
the security of our organization.
So this is just a a brief example
of some of the great information you can find in your logs.
You know, things may look normal,
none of these were abnormal activities
in and of itself, right?
None of these things that we looked
at appeared to violate any rules.
There wasn't any denied activity
and all of this was allowed activity,
and could have been perfectly legitimate.
But don't you wanna know?
So using your logs for at risk operational
and oversight, as well as having good log data
in case you ever have to do a forensic investigation.
Well, that my friends is a closer look at the power of logs.