4.9 — Security Data Sources and Log Data

Log Data

Recorded system, application, endpoint, network, and security-device activity used for monitoring, correlation, and investigation.

Firewall Log

Records network traffic information such as source and destination IP addresses, ports, applications, timestamps, and allow or block decisions.

Firewall Disposition

Result of a traffic flow showing whether the firewall accepted or blocked it.

NGFW Log

Firewall log that may include applications, URLs, URL categories, suspicious data, and anomalies in addition to traditional traffic information.

Application Log

Record created by an application containing events that may help identify operational or security activity.

Windows Event Viewer

Windows utility containing application and other event logs useful during security investigations.

Linux and macOS Log Location

The material identifies the /var/log directory as a common location for logs on Linux and macOS systems.

Endpoint Log

Log generated by devices such as laptops, desktops, phones, or tablets containing user and system activity.

Endpoint Log Examples

Login and logout events, system events, processes, password changes, lockouts, management events, and directory-service activity.

Operating System Security Log

OS log containing security events such as authentication activity, brute-force attempts, critical-file changes, and service changes.

IDS and IPS Logs

Security logs describing detected attacks and potentially including timestamp, classification, priority, addresses, and ports.

IDS or IPS Alert Classification

Description of the type of attack detected, such as a possible denial-of-service or SYN-flood attack.

Network Infrastructure Logs

Logs generated by switches, routers, wireless access points, and VPN concentrators.

Network Infrastructure Log Indicators

May reveal routing-table changes, authentication failures, network attacks, or automatically blocked traffic.

Metadata

Data describing other data.

Email Metadata

May contain sending servers, destination addresses, IP addresses, SPF information, signatures, and message-routing information.

Image Metadata

May identify the device used to create an image and GPS coordinates associated with the picture.

Browser Metadata

May include operating system, browser type, and IP-address information.

Document Metadata

May contain information about the creator such as name, address, phone number, or title.

Vulnerability Scan Log

Records findings identified during vulnerability scanning, including missing protections, misconfigurations, unsupported systems, and known vulnerabilities.

Vulnerability Scan Log Findings

Examples include missing firewalls, missing antivirus, unprotected shares, guest access, unsupported operating systems, and missing patches.

SIEM Log Consolidation

Combining logs from multiple systems into one central platform so events can be filtered, compared, and correlated.

SIEM Correlation

Connecting events from different log sources to follow a traffic flow or security event across multiple systems.

SIEM Automated Report

Automatically generated summary or analysis of information stored in a SIEM.

SIEM Report Limitation

Reports provide little value if no one reviews them, and large reports may require significant processing time.

Dashboard

Customizable or predefined at-a-glance display of current security status, alerts, users, devices, firewall rules, and warnings.

SIEM Report vs. Dashboard

Reports can provide more detailed or historical analysis; dashboards emphasize current information that can be reviewed quickly.

Packet Capture

Recording network packets so traffic can be examined at the packet level.

Wireshark

Packet-analysis utility used to capture and inspect wired or wireless network traffic.

Network Device Packet Capture

Some switches, routers, and firewalls can capture packets directly without relying solely on a separate workstation.

Packet-Level Analysis

Examining individual packets and their contents to understand traffic flows, protocols, applications, and security issues.

HTTP GET in Packet Capture

An unencrypted HTTP packet capture may expose the GET command and subsequent traffic directly.

Logs vs. Packet Captures

Logs summarize recorded events or actions; packet captures provide detailed packet-by-packet network information.

Firewall Logs vs. Endpoint Logs

Firewall logs describe network traffic and allow or block decisions; endpoint logs describe activity occurring on the device.

IDS or IPS Logs vs. Firewall Logs

IDS or IPS logs focus on detected attack patterns; firewall logs primarily document traffic flows and their disposition.

Metadata vs. Log Data

Metadata describes characteristics of another object or file; logs record events and activity over time