Critical Logs To Monitor: A Guide For SOC Analysts

Related Resource:

You Should Know:

1. Essential Logs for SOC Monitoring

Windows Event Logs

Security Logs (Event ID 4624, 4625, 4648)

Get-WinEvent -LogName Security -FilterXPath "[System[(EventID=4624 or EventID=4625 or EventID=4648)]]" -MaxEvents 50

Sysmon Logs (Process Creation, Network Connections)

Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -FilterXPath "[System[(EventID=1 or EventID=3)]]"

Linux Audit Logs

Failed SSH Attempts

grep "Failed password" /var/log/auth.log

Sudo Command Execution
```
ausearch -k sudo_cmds 
```

2. SIEM Query Examples

Splunk Query for Brute Force Attacks

index=windows EventCode=4625 | stats count by src_ip, user | where count > 5

Elasticsearch Query for Suspicious Process Execution

{
"query": {
"match": { "event.action": "Process Creation" } 
}
}

3. Log Retention & Archiving

Linux (Logrotate Config)

/var/log/auth.log { 
daily 
rotate 30 
compress 
missingok 
}

Windows (Event Log Retention via GPO)
```
wevtutil sl Security /ms:104857600 
```

What Undercode Say:

Monitoring critical logs is the backbone of SOC operations. Key takeaways:
– Windows: Focus on Event IDs 4624 (Successful Logon), 4625 (Failed Logon), 4688 (Process Execution).
– Linux: Track /var/log/auth.log, /var/log/syslog, and auditd logs.
– SIEM Rules: Automate detection for brute force, lateral movement, and privilege escalation.
– Retention Policies: Ensure logs are stored for at least 90 days for forensic investigations.

Expected Output:

A well-structured SOC log monitoring strategy reduces MTTD (Mean Time to Detect) and MTTR (Mean Time to Respond).
Use automated scripts, SIEM alerts, and regular log reviews to stay ahead of threats.