Log Analysis, Monitoring, and Detection
Log Analysis, Monitoring, and Detection tests whether you can read telemetry and turn it into a defensible detection. CJCA emphasizes Windows event IDs, Linux logs, network logs, and correlation.
Core rules
- Windows Security log: 4624 successful logon, 4625 failed logon, 4672 special privileges assigned, 4688 process creation, 4720 account created, 4740 account locked. Logon types matter: 2 interactive, 3 network, 10 RDP.
- Sysmon adds process creation (1), network connections (3), file creation (11), and registry changes (12/13/14). Linux authentication events land in
/var/log/auth.logor/var/log/secure; web servers log method, path, status, user agent. - Normalize timestamps to UTC, baseline normal volume, and correlate across sources. A single failed login is noise; many failures followed by a success from one source is a signal.
- Detection engineering reduces false positives with context: asset criticality, user behavior, geo-IP, and known-good allowlists.
Worked example
A SIEM alert shows 40 Event ID 4625 failures for svc_backup from 203.0.113.50 in five minutes, followed by a 4624 success with logon type 3. The pattern suggests password guessing followed by a network logon. Check whether the account should authenticate from that IP, review the source host, and look for subsequent 4672 or 4688 activity. Escalate and contain the account; do not dismiss the alert because the account is a service account.
Traps
4624 is success, 4625 is failure. Logon type 3 is network, not RDP. Time-zone mismatches create false timelines. High log volume is not automatically malicious. A blocked connection still matters as reconnaissance.