4.9 log data sources

Firewall log

Records source/destination IPs, ports, and disposition (allowed/blocked) for traffic crossing the firewall; NGFW logs also show application and URL category data.

DNS sinkhole traffic

Log entries showing DNS requests redirected or blocked, potentially indicating malicious activity on internal systems.

Application log

OS-level logs of application activity: Windows Event Viewer's application log section, or Linux/macOS's /var/log directory.

Endpoint log

Logs from individual devices: login/logoff events, system events, running processes, password changes, lockouts, directory service activity.

OS security log

Operating system logs specifically tracking security-relevant events: brute force attempts, critical file changes, authentication activity.

Unexpected service disruption (log indicator)

A log entry showing a service was disabled when no admin action explains it, a red flag worth alerting on.

Selective log forwarding to SIEM

Not all log data should be sent to the SIEM, only what's relevant for security decision-making, to manage volume.

IPS/IDS log

Records known vulnerability or attack matches, including alert class, priority, source/destination IP and port; example tool: Snort.

Network infrastructure log

Switches, routers, APs, VPN concentrators; logs routing table changes, authentication errors, and detected attacks like automatic blocking of a SYN flood.

Metadata (document/file)

Hidden descriptive data embedded in files: email headers, photo GPS data, browser info, document author and contact details.

Email header metadata

Contains originating servers, SPF results, and signature details; useful for tracing an email's true origin and path.

Vulnerability scan log

Identifies missing firewalls/antivirus, misconfigurations (open shares, enabled guest access), and unpatched or unsupported operating systems.

Automated SIEM reports

Pre-scheduled reports generated from SIEM data; risk is that they get ignored if not actively reviewed, and can be resource-intensive to generate at scale.

Dashboard

Real-time, at-a-glance summary view, customizable or predefined, showing current status; deliberately doesn't cover long-term historical data due to processing time.

Dashboard vs automated report

Dashboards give instant, shallow visibility into current status. Reports give deeper, slower, historical detail, but risk being generated and ignored.

Packet capture

Full-detail network traffic recording at the packet level, using tools like Wireshark or built-in device capture features.

Log data source summary

Firewall shows traffic disposition. App/OS logs show activity and security events. Endpoint shows device-level events. IPS/IDS shows attack matches. Network infrastructure shows routing/auth issues. Vulnerability scans show missing protections. Metadata shows hidden file details. Packet capture shows raw traffic.