Log Analysis
Overview
Log analysis is reviewing event records to understand what happened on a system, network, account, or application — the core skill behind investigating any alert.
Key concepts
- Timestamps, IPs, ports, protocols
- Usernames, hostnames, event IDs, process trees
- File hashes and IOCs
How it works
Log analysis is the process of reviewing event records to understand what occurred on a system, network, account, or application. SOC analysts use it to identify suspicious behavior, investigate alerts, confirm incidents, determine affected systems, and reconstruct the timeline of an event.
Network-level fields
| Term | Meaning |
|---|---|
| Timestamp | The date and time an event occurred. |
| Source / destination IP address | The IP initiating a connection, and the IP receiving it. |
| Port | A numbered communication endpoint used by network services. |
| Protocol | The rules used for communication — TCP, UDP, HTTP, HTTPS, DNS, SSH. |
Host & identity fields
| Term | Meaning |
|---|---|
| Username | The identity associated with an account login or action. |
| Hostname | The name assigned to a computer, server, or network device. |
| Event ID | A numerical identifier categorizing a specific type of logged event. |
| Process / command line | A running program instance, and the text-based command used to start it. |
| Process tree | A record showing parent-child relationships between processes. |
Evidence fields
| Term | Meaning |
|---|---|
| File hash | A unique value calculated from a file's contents, used to identify known malicious or known-safe files. Use SHA-256 or higher, and compare against the distributor's published hashes. |
| Indicator of compromise (IOC) | Evidence a system may have been attacked — a malicious hash, suspicious domain, known malicious IP, or unauthorized account. |