By FixTheVuln Team
Peer-reviewed security content
Sources: CISA, NVD, OWASP
Test Your Knowledge
Key Takeaways
- Windows Event IDs 4624/4625 (logon success/failure) and 4688 (process creation) are the foundation of Windows security monitoring
- Linux authentication logs live in /var/log/auth.log (Debian) or /var/log/secure (RHEL) — know your distro
- Master grep, awk, sort, uniq, and jq for fast command-line log analysis
- Correlation is key: link events across authentication, process, network, and file access logs by timestamp and user
- Always establish a baseline of normal before looking for anomalies
Security Log Analysis Reference
Log analysis is a fundamental skill for security analysts, incident responders, and threat hunters. Knowing which logs to check, what events to look for, and how to quickly extract meaningful patterns separates effective analysts from those overwhelmed by data. This cheat sheet provides quick-reference tables for Windows Event IDs, Linux log locations, command-line analysis techniques, and event correlation patterns you will use daily.
Windows Security Event IDs
These Event IDs from the Windows Security event log are the most commonly analyzed during security investigations. All IDs are from the Microsoft Windows Security Auditing provider.
| Event ID | Event | Category | Security Relevance |
|---|---|---|---|
| 4624 | Successful logon | Logon/Logoff | Track who logged in, when, from where, and logon type (2=interactive, 3=network, 10=RDP) |
| 4625 | Failed logon | Logon/Logoff | Brute force detection, credential stuffing, account lockout investigation |
| 4634 | Logoff | Logon/Logoff | Session duration analysis, correlate with 4624 for full session timeline |
| 4648 | Logon with explicit credentials | Logon/Logoff | RunAs usage, lateral movement with alternate credentials |
| 4672 | Special privileges assigned | Privilege Use | Admin logon detection, privilege escalation monitoring |
| 4688 | New process created | Process Tracking | Command execution tracking (enable command-line logging for full value) |
| 4689 | Process exited | Process Tracking | Process lifetime analysis, correlate with 4688 |
| 4698 | Scheduled task created | Object Access | Persistence mechanism detection — attackers frequently use scheduled tasks |
| 4720 | User account created | Account Mgmt | Unauthorized account creation, backdoor account detection |
| 4722 | User account enabled | Account Mgmt | Re-enabled dormant or disabled accounts |
| 4724 | Password reset attempt | Account Mgmt | Unauthorized password changes, account takeover |
| 4732 | Member added to security group | Account Mgmt | Privilege escalation — user added to Administrators, Domain Admins, etc. |
| 4738 | User account changed | Account Mgmt | Account modification tracking, attribute changes |
| 4776 | NTLM authentication attempt | Account Logon | NTLM relay attacks, legacy authentication monitoring |
| 7045 | New service installed | System | Persistence and privilege escalation via service creation (System log, not Security) |
| 1102 | Audit log cleared | System | Anti-forensics — attacker clearing their tracks (always investigate immediately) |
Note: Windows logon types in Event 4624: Type 2 (Interactive/console), Type 3 (Network/SMB), Type 4 (Batch), Type 5 (Service), Type 7 (Unlock), Type 10 (RemoteInteractive/RDP), Type 11 (CachedInteractive).
Linux Log Locations
| Log File | Distro | Contents | Security Use |
|---|---|---|---|
| /var/log/auth.log | Debian/Ubuntu | Authentication events: SSH, sudo, PAM | Failed logins, brute force, privilege escalation |
| /var/log/secure | RHEL/CentOS | Authentication events: SSH, sudo, PAM | Same as auth.log for RHEL-based systems |
| /var/log/syslog | Debian/Ubuntu | General system messages | Service start/stop, cron execution, system errors |
| /var/log/messages | RHEL/CentOS | General system messages | Same as syslog for RHEL-based systems |
| /var/log/audit/audit.log | All (with auditd) | Kernel-level audit events | File access, syscalls, SELinux denials, user actions |
| /var/log/kern.log | Debian/Ubuntu | Kernel messages | Hardware errors, kernel exploits, module loading |
| /var/log/cron | RHEL/CentOS | Cron job execution | Scheduled task abuse, persistence mechanisms |
| /var/log/apache2/access.log | Debian/Ubuntu | Web server access logs | Web attacks, SQLi attempts, directory traversal |
| /var/log/httpd/access_log | RHEL/CentOS | Web server access logs | Same as above for RHEL-based systems |
| /var/log/faillog | All | Failed login attempts | Brute force tracking (use faillog command to read) |
| /var/log/lastlog | All | Last login per user | Detect dormant account usage (use lastlog command) |
Bash Commands for Log Analysis
# --- Authentication Analysis ---
# Count failed SSH logins by source IP (Debian/Ubuntu)
grep "Failed password" /var/log/auth.log \
| awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -20
# Count failed SSH logins by source IP (RHEL/CentOS)
grep "Failed password" /var/log/secure \
| awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -20
# Show successful SSH logins with timestamps
grep "Accepted" /var/log/auth.log \
| awk '{print $1, $2, $3, $9, $11}' | tail -50
# Find sudo commands executed
grep "COMMAND=" /var/log/auth.log \
| awk -F'COMMAND=' '{print $2}' | sort | uniq -c | sort -rn
# --- Web Server Analysis ---
# Top 20 requesting IPs
awk '{print $1}' /var/log/apache2/access.log \
| sort | uniq -c | sort -rn | head -20
# Find potential SQL injection attempts
grep -iE "(union.*select|or.*1.*=.*1|drop.*table|insert.*into)" \
/var/log/apache2/access.log
# Find directory traversal attempts
grep -E "\.\./\.\." /var/log/apache2/access.log
# HTTP status code distribution
awk '{print $9}' /var/log/apache2/access.log \
| sort | uniq -c | sort -rn
# --- Timeline Analysis ---
# Extract events in a specific time window
awk '$0 >= "Mar 6 14:00" && $0 <= "Mar 6 15:00"' /var/log/auth.log
# Count events per minute (for spike detection)
awk '{print $1, $2, $3}' /var/log/auth.log \
| cut -d: -f1,2 | sort | uniq -c | sort -rn | head -20
# --- JSON Log Analysis with jq ---
# Parse JSON logs (e.g., cloud audit trails)
cat audit.json | jq -r '.events[] | [.timestamp, .user, .action, .resource] | @tsv'
# Filter specific actions
cat audit.json | jq '.events[] | select(.action == "DeleteBucket")'Correlation Patterns
Individual log events tell a limited story. The real power of log analysis comes from correlating events across multiple sources to reconstruct attack narratives.
| Pattern | Events to Correlate | Indicates |
|---|---|---|
| Brute Force → Success | Multiple 4625 (failed) from same IP followed by 4624 (success) for same account | Successful password attack — immediate investigation needed |
| Lateral Movement | 4624 Type 3 (network logon) from internal IP + 4688 (process creation) on target host | Attacker moving between systems using compromised credentials |
| Privilege Escalation | 4732 (added to admin group) or 4672 (special privileges) shortly after 4624 | Account gaining elevated access — verify authorization |
| Persistence Installation | 4698 (scheduled task) or 7045 (new service) created by non-admin or from unusual path | Attacker establishing persistence mechanism |
| Data Exfiltration | Large outbound transfers (proxy logs) + DNS TXT queries (DNS logs) from same host | Data being exfiltrated via web or DNS channels |
| Anti-Forensics | 1102 (log cleared) + 4688 showing wevtutil or Clear-EventLog commands | Attacker destroying evidence — treat as confirmed compromise |
Log Analysis Workflow
| Step | Action | Tools/Techniques |
|---|---|---|
| 1. Scope | Define the time window, systems, and users of interest | Incident ticket, alert context, threat intelligence |
| 2. Collect | Gather relevant logs from all applicable sources | SIEM queries, log forwarding, direct access |
| 3. Normalize | Ensure consistent timestamps (UTC), field names, and formats | Log parsing, timestamp conversion, field mapping |
| 4. Filter | Remove noise — known-good events, scheduled tasks, monitoring systems | grep -v, allowlists, SIEM filters |
| 5. Analyze | Look for anomalies, known-bad indicators, and suspicious patterns | Pattern matching, statistical analysis, IOC searches |
| 6. Correlate | Link events across sources to build a timeline and narrative | Timeline tools, SIEM correlation, manual pivoting |
| 7. Document | Record findings, IOCs, affected systems, and recommended actions | Investigation notes, IOC lists, timeline artifacts |
Explore More Blue Team Guides
For comprehensive tutorials and security guides:
Visit FixTheVuln.com →Related Resources
FixTheVuln Store
Get the CompTIA CySA+ Study Planner
Fillable PDF study planners with domain trackers, weekly schedules, and progress tracking. Available in Standard, ADHD-Friendly, Dark Mode, and 4-Format Bundle.
CompTIA CySA+ Planner60+ certifications available — from $5.99
FixTheVuln Store
Patch Tuesday Sprint Kit
5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.
Try Free Templates Subscribe — $4.99/moCyberFolio
Choosing your next cert? Track them all in one place.
Build a shareable cybersecurity portfolio that highlights your certifications, projects, and skills — free.
Build Your Portfolio →