MODULE 2: Logs, Events & Security Monitoring

One of the most important responsibilities of a Security Operations Center (SOC) is monitoring system activity to detect potential cyber threats. Every device, application, and system inside an organization continuously generates records of activity. These records are called logs.

Logs are critical for cybersecurity because they provide visibility into what is happening across an organization’s infrastructure.

Without logs, security teams would have no way to determine:

• Who accessed a system
• When an action occurred
• What activity took place
• Whether suspicious behavior is happening

In this module, learners will understand how security logs work, how attackers leave traces in logs, and how SOC analysts monitor events to detect potential cyber threats.

Lesson 1: What Are Logs?

A log is a recorded entry that documents an event that occurs within a system, application, or network.

Every time a user logs into a system, accesses a file, sends network traffic, or performs an operation, that activity can be recorded as a log entry.

Logs typically contain information such as:

• Timestamp (when the event occurred)
• User account involved
• Source IP address
• Device or system generating the log
• Action performed
• Status of the event (success or failure)

Logs serve as a digital trail of system activity, helping security teams understand exactly what happened within a system.

Lesson 2: Why Logs Are Critical for Cybersecurity

Logs provide the visibility necessary to detect suspicious behavior.

Cyber attackers rarely operate without leaving traces. Even if an attacker attempts to hide their activity, logs often reveal abnormal patterns that security analysts can investigate.

Logs help organizations:

• Detect unauthorized access attempts
• Investigate suspicious login activity
• Identify malware behavior
• Detect abnormal network traffic
• Investigate data exfiltration attempts
• Reconstruct the timeline of a security incident

For SOC teams, logs act as the primary source of evidence during security investigations.

Lesson 3: Types of Logs Used in Security Monitoring

Organizations generate different types of logs depending on the systems involved.

Understanding these log types helps analysts identify where suspicious activity may appear.

System Logs

System logs record activities occurring within operating systems.

Examples include:

• User login attempts
• System startup and shutdown events
• Software installation
• Permission changes
• Administrative actions

System logs help analysts detect unauthorized access and system changes.

Firewall Logs

Firewalls monitor and control network traffic entering or leaving a network.

Firewall logs record:

• Incoming and outgoing connections
• Blocked network traffic
• Allowed connections
• Suspicious IP addresses
• Port scanning attempts

These logs are essential for detecting network attacks.

Authentication Logs

Authentication logs track login activity.

These logs record:

• Successful login attempts
• Failed login attempts
• Password changes
• Account lockouts
• Remote access attempts

Authentication logs are extremely useful for identifying brute-force attacks and credential compromise.

Application Logs

Applications also generate logs.

These logs track activity inside software systems such as:

• Web servers
• Databases
• Cloud applications
• Enterprise platforms

Application logs help detect attacks such as:

• SQL injection
• Unauthorized data access
• Application errors triggered by attackers

Network Logs

Network devices also generate logs related to network traffic.

These logs may include:

• Network connections
• DNS requests
• Data transfer activity
• Suspicious traffic patterns

Network logs help analysts detect command-and-control communication and unusual traffic behavior.

Lesson 4: How Attackers Leave Traces in Logs

Even sophisticated attackers leave traces behind when interacting with systems.

These traces appear as unusual activity patterns in logs.

Common attacker behaviors visible in logs include:

• Multiple failed login attempts
• Login attempts from unusual geographic locations
• Access outside normal working hours
• Sudden creation of new administrative accounts
• Large file downloads
• Unexpected network connections

By analyzing these patterns, SOC analysts can detect potential security incidents.

Lesson 5: Introduction to Log Analysis

Log analysis is the process of reviewing logs to identify suspicious activity.

SOC analysts analyze logs to answer questions such as:

• Who accessed the system?
• When did the activity occur?
• What actions were performed?
• Was the activity legitimate or malicious?

Log analysis often involves:

• Searching logs for unusual patterns
• Filtering logs based on specific criteria
• Investigating abnormal behavior
• Correlating multiple events together

Log analysis is one of the core skills required for SOC analysts.

Lesson 6: Indicators of Compromise (IOC)

An Indicator of Compromise (IOC) is a piece of evidence suggesting that a system may have been breached.

IOCs help security teams identify potential attacks quickly.

Examples of IOCs include:

• Suspicious IP addresses
• Malicious file hashes
• Unusual login locations
• Unexpected process activity
• Communication with known malicious domains

SOC teams continuously monitor logs for these indicators to detect cyber-attacks early.

Lesson 7: Security Monitoring in SOC Environments

Security monitoring is the continuous observation of systems and networks to identify abnormal behavior.

SOC teams use monitoring tools that collect logs from multiple systems and display them in a centralized environment.

These tools allow analysts to:

• Monitor system activity in real time
• Investigate alerts generated by monitoring systems
• Correlate events from multiple systems
• Identify patterns of suspicious behavior

Continuous monitoring helps organizations detect attacks before they escalate into serious security incidents.

Lesson 8: Simple Log Investigation Example

To understand how logs help detect attacks, consider the following scenario.

A system log shows:

User: admin
Location: Nigeria
Time: 03:14 AM
Activity: Successful login

However, the employee normally works in London and never logs in during early morning hours.

This unusual login pattern may indicate:

• Compromised credentials
• Unauthorized access
• Potential account takeover

SOC analysts would immediately begin investigating this event.

Key Concepts Introduced in Module 2

After completing this module, learners will understand:

• What logs are and how they are generated
• Why logs are essential for cybersecurity monitoring
• Different types of logs used in enterprise environments
• How attackers leave traces inside system logs
• The basics of log analysis techniques
• What Indicators of Compromise (IOC) are
• How SOC teams monitor security events in real time

This knowledge prepares learners to understand how SIEM platforms collect and analyze logs to detect cyber threats, which will be explored in the next module.