Log Analysis & Continuous Security Monitoring

• Event Logs

  • Windows

    • Application

    • Security

    • System

    • Setup

    • Forwarded

  • Severity (Windows Scale):

    • Information

    • Warning

    • Error

    • Audit success/failure

  • Linux

    • Text files in /var/log/*

    • Systemd uses journalctl (binary)

  • MacOS

    • “Console” app

    • Also test logs, just like Linux

  • Log Analysis

    • Correlation of events

    • Configuration changes

    • Gaps in time

    • Trend analysis

  • Syslog

    • Old protocol, UDP 514

    • No built in security

    • Newer versions: security, TCP 1468

    • Log archiving.

    • Structure:

      • Header: timestamp, IP address

      • Facility

      • Severity

      • Message

  • Firewall Logs

    • Source of information for devices involved in security incidents.

    • Log traffic permitted or dropped.

    • Statistics

    • Centralized storage recommended

  • Proxy logs

    • Forward proxies

      • Outbound traffic

      • Transparent

      • Non-transparent

    • Reverse proxies

      • Inbound traffic

      • Load balancers, basically.

      • Look for malicious requests

  • Web Application Firewall (WAF) Logs

    • A WAF scans application level (web) requests for intrusion attempts

    • Logs suspicious and malicious attempts for:

      • Malformed inputs

      • SQLi

      • Buffer overflows

      • Brute force logins

      • XML, JSON injection attempts

      • XSS, CSRF

  • IDS/IPS Logs

    • An intrusion detection/prevention device uses signatures to match suspicious traffic.

    • Can generate a lot of logging activity

    • Require rule tweaking

    • Alerts ingested in SIEM