Log Management
Log Management
Log management is the lifecycle: generation → collection → transport → storage → retention → analysis → disposal. Candidates must know why each stage matters to investigations and compliance.
Key concepts:
- Centralization: forwarding logs off-host protects evidence if the host is compromised.
- Time synchronization (NTP): without consistent clocks, correlation and timelines break. UTC is the standard for analysis.
- Integrity: hashing, write-once storage, and access controls preserve evidentiary value.
- Retention: driven by legal/regulatory requirements and investigation needs; know that retention periods differ by data type.
- Log levels and verbosity: too little detail defeats investigation; too much creates cost and noise.
- Transport security: syslog over TLS, encrypted channels; plaintext syslog is a confidentiality risk.
- Windows event IDs worth knowing: 4624 (logon success), 4625 (logon failure), 4688 (process creation), 4720 (account created), 1102 (audit log cleared).
Traps: assuming local logs survive an attacker (they often do not); ignoring clock skew as a cause of "missing" events; confusing retention with backup; and forgetting that log clearing (Event ID 1102) is itself a high-value detection.
Rule of thumb: If logs only exist on the compromised host, assume they are gone. Centralize, timestamp in UTC, and protect integrity.
Worked example: An analyst cannot correlate an EDR alert with a firewall event. The EDR host is in local time, the firewall in UTC. The correct first step is to normalize timestamps to UTC before concluding the events are unrelated.