Network and System Log Analysis
What the domain tests
Network and system log analysis: source selection, retention, time sync, event-level interpretation, and correlation. The exam expects you to spot authentication bursts, new services, log gaps, and exfiltration patterns.
Core rules
- PCI DSS Requirement 10 expects logging of access to card data, admin actions, audit trails, time synchronization, daily review, and 12 months retention with 3 months immediately available.
- Sources: Windows Security/System/Application, Sysmon, Linux auth/syslog, firewall, IDS/IPS, proxy, DNS, VPN, AD, database, and POS application logs.
- Windows events worth memorizing: 4624 logon (types 2 interactive, 3 network, 10 RDP), 4625 failure, 4672 special privileges, 4688 process creation, 4720 account created, 7045 service installed, 1102 log cleared, 4104 PowerShell.
- Linux: sshd accepted/failed, sudo, cron, useradd, and auditd.
- Normalize to UTC, baseline normal, pivot on user/IP/host, and check log integrity and centralization.
Worked example
A firewall shows 40 failed RDP attempts from an external IP, then a 4624 type 3 for a POS service account at 02:00, a 7045 for a new service, and a 1102. Reasoning: brute force succeeded, the attacker moved laterally with a service account, installed persistence, and cleared logs. Because 1102 creates a gap, use firewall, proxy, and SIEM copies to reconstruct.
Traps
Believing logs are reviewed annually; retaining all 12 months online; assuming 4624 is always interactive; treating cleared logs as proof nothing happened; ignoring time-zone differences; overlooking service-account logons.