Prof Messer CompTIA Security+ SY0-701 - 4.9

security log files

blocked and allowed traffic flows, exploit attempts, blocked URL categories etc

critical security info

- documentation of every traffic flow

- summary of attack info

- correlate with other logs

firewall logs

traffic flows thru firewall

- source/destination IP, port #s, etc

NGFW

- apps used, url filtering categories, anomalies and suspicious data

application logs

specific to app

windows

- event viewer/app log

linux/macOS

- /var/log

parse details on a SIEM tool

endpoint logs

lots of data

- logon events, policy changes, system events, processes, acc management, etc

attackers often gain access to endpoints

everything rolls up into SIEM

correlate with log data from other devices

OS specific security logs

OS security events

- monitoring apps, brute force, file changes, auth details, etc

might be able to help you find problems before they happen

- signs of an attack, etc

may require filtering

- dont send everything to the SIEM

IPS/IDS logs

usually integrated into a NGFW

contain info about predefined vulnerabilities

- known OS vulnerabilities, generic security events

correlate with other log info on SIEM

common data points

- timestamp

- type or class of attack

- source and destination IP

- source and destination port #

network logs

switches, routers, VPN concentrators, etc

network changes

- routing updates

- auth issues

- network security issues

metadata

data that describes other data sources/files

ex:

email

- header details, sending servers, destination address, etc

mobile

- type of phone, GPS location, etc

Web

- OS, browser type, IP address

vulnerability scan log info

lack of security controls

- no firewall, antivirus, antispyware

misconfigurations

- open shares

- guest access

real vulnerabilities

- need to be patched

dashboards

real time status info

customize info on screen

shows most important data

packet captures

gather packets on the network

view detailed traffic information

- identify unknown traffic

- verify security controls