EDUCATION, LOGO, DFIR / SIEM

📊 Logfile (window) analysis

The analysis of log files (windows) is the systematic collection, correlation and evaluation of event records to detect attacks in a timely manner, support incident investigation and meet compliance requirements. The Roadmap covers the entire process in six sections - from magazine sources and formats to centralised analysis of SIEs and signs of attack - based on recognised standards (NIST SP 800-92 and its Rev.1 project, ISO 2701, OWASP). Examples are fictional, designed for training.

What is window analysis

Log management life cycle - NIST SP 800-92

The logfile (log) is a chronological record of events in the system - who, when, where and what he did. Window analysis is the process of collecting, normalising and evaluating these records to detect security incidents, support investigations and comply with compliance requirements. NIST SP 800-92 is described as a continuous life cycle from event generation to controlled disposal.

Basic principle: analyze centrally and outside the host to be tested - in a compromised system windows can no longer be trusted. The findings of the analysis reversibly specify what and how to log.

detection

Danger Detection

Windows are the main source of early detection of attacks - failed login, change of privileges, abnormal network traffic.

DFIR

Investigation

During an incident, windows reconstruct event chronology (timeline) - what the attacker did when and how far was.

compliance

Eligibility

ISO 27001, PCI DSS, NIS2 and GDPR require logs to be written, stored and regularly reviewed.

audit

Liability

Continuing audit records provide a non-repudiation - which entity performed whose activities.

baseline

Activity Report

Errors and performance windows help to determine the norm (baseline) and to detect its deviations.

IMO RES. A.807 (19)

What log

Authentication, refusal of access, changes in configuration and rights, administrative actions and errors.

First look at the logs

Before analysing, check that logs are being written and the time is correct.

Linux

$journalctl -p warning --since '1 hour ago'
Warnings and errors in the last hour.
$journalctl -f
Follows the log live.
$timedatectl
Whether the time is synchronised. Without it events cannot be compared.
$journalctl --disk-usage; ls -lh /var/log
How much space the logs use.

Windows

PS>Get-WinEvent -LogName System -MaxEvents 20
Latest system events.
$wevtutil gl Security
Security log size and retention.

Disable Sensitive

Passwords, tokens, full card numbers and unnecessary personal data are not recorded in the windows (GDPR data minimisation) - masks or skips.

Noise signal

More windows are not better - without normalisation and selection analysts drown in noise. Defines what really needs to be monitored.

Unitary time

For all sources, synchronized time (NTP) and UTC. Without this, events from different systems cannot be correctly grouped (ISO 27001 A.8.17).

Where windows are created and how they look

Classification of sources and common formats

Windows come from many layers - operating systems, network equipment, applications and cloud. To compare and correlate them, different formats are normalised into a single scheme. Structured formats (JSON) are machine readable and greatly facilitate automatic analysis compared to free text lines.

Operating system

Linux: syslog, journald, /var/log/auth.log, auditd. Windows: Security / System / Application Event Log (EVTX), Sysmon. macOS: Unified Logging (log show), OpenBSM auditd.

NET

Network

Firewall, IDS/IPS (Suricata, Zeek), proxy, VPN, DNS requests, NetFlow / flow window.

APP

Applications

Web server (access / error window), database, application business events - preferably structured (JSON).

CLOUD

Cloud and Identity

AWS CloudTrail, Azure Activity, GCP Audit Window, VPC flow window. IdP (Entra ID, Octa) login events.

Format	Type	Where to occur	Remarks
Syslog (RFC 5424)	partly structured	Linux/Unix, network equipment	Standard protocol for transmission. Contains facility, security, timestamp, host.
JSON	structured	modern applications, cloud	Machine readable (key-value). Simple parsing and searching. Recommended format.
Windows EVTX	structured (binary)	Windows Event Log	Events with Event ID. Reading with wevtutil / Get-WinEvent or SIEM agent.
CEF / LEEF	structured	security equipment, SIEM	Independent formats of producers for the transmission of events to SIEM.
W3C / Combined	partly structured	nginx, Apache, EES	Web server access log. Fields in a fixed order, parse with grock.

One event, three formats (examples)

# 1) syslog (RFC 5424) - daļēji strukturēts
<38>1 2026-06-03T14:22:01.003Z srv-01 sshd 2913 - - Failed password for root from 203.0.113.7 port 51022 ssh2

# 2) nginx combined - tīmekļa access log
203.0.113.7 - - [03/Jun/2026:14:22:01 +0000] "POST /admin/login HTTP/1.1" 401 564 "-" "curl/8.2"

# 3) JSON - strukturēts (mašīnlasāms, ieteicams)
{
  "ts": "2026-06-03T14:22:01Z", "host": "srv-01", "event": "auth.failure",
  "user": "root", "src_ip": "203.0.113.7", "service": "sshd", "outcome": "failure"
}

Commands for each source

Each source has its own path and format.

Operating system

$journalctl -u ssh --since today
Records of one service today (`sshd` on the RHEL family).
$last -a | head; lastb -a | head
Successful and failed logins.
$ausearch -m USER_LOGIN -ts today -i
Logins from auditd.

Web server

$tail -f /var/log/nginx/access.log
Requests live.
$awk '{print $9}' access.log | sort | uniq -c | sort -rn
Status code distribution (combined format).

JSON and containers

$jq -r 'select(.level=="ERROR") | [.time,.message] | @tsv' app.log
Errors from a JSON log.
$docker logs --since 1h -t <konteiners>
Container log with timestamps.
$kubectl logs <pods> --since=1h --previous
Log of the previous restarted container.

Normalisation

Fields from different sources are converted into a single schematic (e.g. ECS - Elastic Common Schema) so that different windows can be searched and correlated together.

Parse

Free text rows shall be divided into fields with samples (gron, regex). Structured JSON windows prevent this step to a large extent.

Enrichment

The events are complemented by a context: the country after the IP (GeoIP), the role of the system, the reputation of the address (three intel) - then the decision is made faster.

From source to SIEM

Centralised collection, storage and integrity

The window should not be analysed only on the installation where they originated: if the system is compromised, the attacker can delete or change them. Therefore, windows are delivered as soon as possible outside the host to a central (append-only) storage facility where they are parse, indexed and analysed.

Integrity: windows are delivered out of the host quickly, stored append-only/WORM and checked by the mixing (hash). Storage period (retention) according to regulations and investigative needs - PCI DSS takes one year, NIS2 does not set a specific deadline (in practice at least 12 months). Time synchronized (NTP, UTC), otherwise events from different sources cannot be correctly correlated.

One entry path step by step

From event server to analyst's decision.

Suspicious application

1
ServerFive unsuccessful applications, then successful - time from NTP, UTC
Without synchronized time events from different systems cannot be put in the correct order.
2
Server → SIEMsyslog over TLS
The attacker sees in the network: only encrypted flow
The record immediately leaves the server. If the attacker later takes over the server, the copy is already elsewhere.
3
SEMParse fields: time, user, IP address, country→append-only + mixing sum
In the store, entries can only be added or corrected - it is the value of evidence.
4
SEMCorrelation rule: failure + successful application from a new country
One record doesn't mean anything. A combination of several events gives warning.
5
SIEM → SOCa background warning
Analyst receives not only record, but also user history and other system events.
6
SOCTriage: is the user on a trip? or was MFA? what happened then?
A false alarm must be distinguished from an incident. If this is an incident, the reaction begins.
7
SOC → SIEMclarification of the provision
Every false positive is the reason to improve the rule, otherwise alarms become noise.

Collection and integrity checks

Checks the path from source to the central system and that records were not changed.

Path to the centre

$logger -p auth.warning 'tests-12345'
Creates a test record to look for in the central system.
$rsyslogd -N1
Validates the rsyslog configuration without a restart.
$openssl s_client -connect <siem>:6514 </dev/null
Checks the syslog TLS connection.

Retention and integrity

$logrotate -d /etc/logrotate.conf
Shows the rotation plan without changing anything.
$sha256sum auth.log.1 >> arhivs.sha256; sha256sum -c arhivs.sha256
A hash for the archive and its verification.
$sudo chattr +a /var/log/auth.log
The file can only be appended to. Remove with `chattr -a` if rotation needs it.
$journalctl --verify
Checks the integrity of journald files.

Centralisation

All windows in one place allow to correlate events between systems and protect evidence if source equipment is compromised.

Integrity

Append-only/WORM storage and mixing amounts (hash) prevent unseen editing - essential for legal value.

Retention

The time limit for storage shall be set by law and by the need for investigation. By maturity - controlled destruction, not natural deletion.

Safe transmission

The windows are sent via an encrypted channel (syslog over TLS, RFC 5425) with buffering so that a short-term network failure does not lose them.

How Data Gets Discovery

Analytical techniques and Pyramid of Pain

The analysis of windows combines detection by known samples with an analysis of behaviour (anomaly). David Bianco's 'Pyramid of Pain' model arranges the indicators according to how difficult it is to attack them: the higher the pyramid is based on discovery, the more durable it is.

Pyramid of Pain: on the right - how easy the attacker to replace the indicator. Discovery by behavior (TTP, above) is much more persistent than after a single IP or mixer sum (down), which the attacker replaces easily.

provisions

Signature / Regulations

Examples of known attacks as search rules (e.g. Sigma, correlation). Exactly, but only notice known.

baseline

Detection of abnormalities

First, the norm (baseline) is determined, then the deviation - unusual time, volume, geography, rare actions.

EUBA

Conduct analysis

User & Entry Behavior Analytics - creates the usual behavior of each user and system and warns if it changes.

correlation

Correlation

Link events from different sources into one scene - e.g. application failed + success + change of privileges.

threeshold

Threshold / aggregation

Counts events in the window - e.g. N failed login per minute from one IP = brute force alarm.

timeline

Chromology (timeline)

The events are arranged in order of time axis (super-timeline) for the reconstruction of an incident - e.g. with Plaso / Timesketch.

Commands for analysis techniques

Techniques you can apply to one file without a SIEM.

Frequency and rarity

$awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -20
Most requests per address.
$awk '{print $7}' access.log | sort | uniq -c | sort -n | head -20
The rarest paths are often the most interesting.

Time slices

$awk '{print substr($4,2,17)}' access.log | uniq -c | sort -rn | head
The minutes with the highest volume.
$journalctl --since '2026-01-15 09:00' --until '2026-01-15 09:30'
One time window across all services.

Rules

$sigma convert -t splunk -p sysmon noteikums.yml
A Sigma rule as a query for a specific system.
$grep -Ff zinamas-adreses.txt access.log
Compares the log with an indicator list.

Sigma

Manufacturer independent disclosure rules format (YAML). One rule is converted into different SIEM queries (SPL, KQL, EQL).

MITRE ATT&CK

An attacker's tactics and technical knowledge base. Window discoveries are drawn to specific techniques to evaluate coverage.

False alarms

Rules must be regulated - too widely causes false alarm and analyst fatigue, too narrowly miss attacks.

Enrichment

Threat intelligence, GeoIP and active contexts increase the accuracy of discoveries and accelerate prioritisation.

What to look for in windows

Typical signs of attacks and key events

Most attacks leave traces in log files. The following shows how to recognise the most frequent stages of attack in the operating systems - Windows (Event ID), Linux (auth.log) and macOS (Unified Logging) - and network telemetry (tcpdump, tshark, Zeek), linking them to attack phases after MITRE ATT&CK.

A separate event may be normal - a sign of it sequence and time compressionwhat the correlation reveals. Audit log clearance (1102) is anti-forensics signal.

Event ID	Source	Meaning	What to notice
4624	Security	Successful application	Logon Type: 2 interactive, 3 network, 10 RDP
4625	Security	No login failed	Much in a row from one IP = brute force. Many accounts = password spray
4648	Security	Application with separately specified accreditation data	sign of speech, lateral movement
4672	Security	Special privileges granted	Administrative session - link to 4624
4688	Security	A new process has been created	Command line arguments (if enabled). Suspected parental-child processes
4720 / 4732	Security	Account created / added to group	Escalation of privileges, persistence
4768 / 4769	Security	Kerberos TGT / TGS	Signs of Kerberoasting, Golden / Silver ticket
7045	System	New Service Installed	stability; unusual service name or path
1102	Security	Audit log cleared	Anti-forensics - almost always suspicious
Sysmon 1/3/11	Sysmon	Process / Network / File	Detailed telemetry. Essential for EDR-style detection

One feature in three operating systems - search for the source of failed applications

─── LINUX, /var/log/auth.log (vai: journalctl -u ssh) ───
Jun  3 14:22:01 srv-01 sshd[2913]: Failed password for root from 203.0.113.7 port 51022 ssh2
Jun  3 14:23:11 srv-01 sshd[2960]: Accepted password for deploy from 203.0.113.7 port 51190 ssh2   # ← veiksme + sudo seko
$ grep "Failed password" auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn

─── WINDOWS, Security Event Log (PowerShell) ───
PS> Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 200 |
       Group-Object { $_.Properties[19].Value } | Sort-Object Count -Descending   # avota IP pēc 4625

─── macOS, Unified Logging (log show) ───
$ log show --last 1h --predicate 'process == "sshd" AND eventMessage CONTAINS "Failed"'
2026-06-03 14:22:01.003+0000  sshd: Failed password for root from 203.0.113.7 port 51022 ssh2
$ log show --predicate 'process == "sudo"' --last 30m   # sudo / privilēģiju eskalācija

Network telemetry - C2 communication and data export characteristics (tcpdump, tshark, Zeek)

─── tcpdump, pakešu līmenis - savienojumi ar aizdomīgo IP ───
$ tcpdump -ni eth0 'host 203.0.113.7 and tcp port 22'
14:22:01.003 IP 203.0.113.7.51022 > 10.0.0.5.22: Flags [S], seq 0, length 0
14:22:01.004 IP 10.0.0.5.22 > 203.0.113.7.51022: Flags [R.], # atteikts

─── tshark, DNS pieprasījumi - tunelēšanas / exfil pazīme (gari, reti domēni) ───
$ tshark -r capture.pcap -Y "dns.flags.response == 0" -T fields -e dns.qry.name
a8f3c1d9e7b2...e9.exfil.example   # neparasti garš subdomēns = iespējama DNS tunelēšana

─── Zeek, conn.log - beaconing (regulāri, vienāda izmēra savienojumi uz vienu mērķi) ───
$ cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p duration orig_bytes |
       sort | uniq -c | sort -rn | head
   240  10.0.0.5  198.51.100.9  443  1.01  512   # ← 240 gandrīz identiski savienojumi = iespējams C2 beacon

access

Brute force / spray

Many failed logins (4625 / Filed password). Brute force - one IP. Password spray - one password against many accounts.

movement

Local movement

4624 Type 3 + 4648 between hosts, unusual administrative links, use of remote services.

durability

Persistence

New services (7045), planned tasks (4698), cron changes, new accounts (4720) - to keep access.

skiing

Foot-skiing

Audit log cleaning (1102), missing intervals, off logging - clear anti-forensics signal.

exportation

Data removal

Unusual large output, DNA tunnelling, connections to unknown destinations in non-standard time.

web

Web attacks

SQLi / XSS samples in access window, 4xx/5xx compactions, scanner User-Agent strings, access to admin roads.

Typical reviews for attack signs

The result is a lead, not proof. Check it against a second source.

Logins on Linux

$grep 'Failed password' /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head
Addresses with the most failed attempts.
$grep 'Accepted' /var/log/auth.log
Successful logins: compare with earlier failures.
$grep 'sudo:' /var/log/auth.log | grep COMMAND
What was run with elevated privileges.

Logins on Windows

PS>Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625} -MaxEvents 100
Failed logins.
PS>Get-WinEvent -FilterHashtable @{LogName='Security';Id=4720,4728,4732}
New accounts and additions to groups.
PS>Get-WinEvent -FilterHashtable @{LogName='Security';Id=1102}
The security log was cleared.

Web

$awk '$9==404 {print $1}' access.log | sort | uniq -c | sort -rn | head
Many 404s from one address are usually a scan.
$awk '$9 ~ /^5/ {print $7}' access.log | sort | uniq -c | sort -rn | head
Paths with server errors.
$awk -F'"' '{print $6}' access.log | sort | uniq -c | sort -rn | head
The most common User-Agents, tools often name themselves.

Ecosystem and references

Tools, good practices and international standards

Tools for reviewing logs

A more convenient view of the same file, without a central system.

In the terminal

$lnav /var/log/nginx/
Merges files by time, with filters.
$goaccess access.log --log-format=COMBINED
A web log overview.

SEM

Centralized, indexed and correlated windows with alarms and dashboards: Splunk, Elastic Security, Microsoft Sentinel, QRadar, Wazuh, Graylog.

Agents / shippers

Collect and send windows to the center: Filebeat, Winlogbeat, Fluentd / Fluent Bit, rsyslog, syslog-ng, NXLog.

Opening languages

Rules and queries: Sigma (independent), Splunk SPL, Microsoft KQL, Elastic EQL; CLI - grep, awk, jq.

Host / IR

Endpoint and investigation: auditd, Sysmon, osquery; timeline - Plaso / log2timeline, Timesketch.

Centralize and backup

The windows are taken out of the host immediately. Keep append-only/WORM with a mess check.

Synchronize time

NTP and UTC for all sources - without which the correlation between systems is not reliable (ISO 27001 A.8.17).

Structure (JSON)

Structured windows facilitate parsing, search and automation. Defines a single scheme.

Unique Secrets

Mask passwords, tokens and excess personal data (GDPR data minimisation).

Regulate alarms

Reviews and rules apply to reduce false positive and alert fatigue.

Link to IR

Discoveries go to incident response process (NIST SP 800-61 Rev. 3) - windows are its fuel.

SP 800-92Guide to Computer Security Log Management (NIST)2006 SP 800-61Computer Security Incident Handling Guide2012 SP 800-137Information Security Continued Monitoring (ISCM)2011 RFC 5424The Syslog Protocol2009 RFC 5425TLS Transport Mapping for Syslog2009 OWASP A09Security Logging and Monitoring Files2021 CIS Ctrl 8Audit Log Management (CIS Controls v8.1)2021 ISO 27001A.8.15 Logo, A.8.16 Monitoring, A.8.17 Time synchronization2022 PCI DSS 10Journaling and access monitoring (Req. 10)v4.0 ATT&CKMITRE - attacker tactics and techniques- SigmaFormat of independent disclosure rules for manufacturers-

Relationship to the NIS2

The NIS2 (EU 2022/2555) requires the logging, monitoring and detection of incidents. Keeping windows supports reporting obligations.

DGPR

Windows often contain personal data (IP, username) - they are subject to data minimisation, storage periods and access control.

Reservation

The material is an educational overview, not a full text of standards. Specific implementation should always be considered as an official source.

Abbreviations

Abbreviations used in the Roadmap: the original name and what it means.

SIEM: Security Information and Event Management - central collection of magazines, correlation and warnings.
SOC: Security Operations Center - a team that monitors security events.
UEBA: User and Entity Behavior Analytics - compare the behaviour of users and systems with that of usual and warn against anomalies.
TTP: Tactics, Techniques and Procedures - attacker action type - harder to replace for address or file.
MITRE ATT&CK: Public attacker tactics and technical knowledge base.
EDR: Endpoint Detection and Response - monitoring and response of computers and servers.
IDS / IPS: Intrusion Detection / Prevention System - intrusion detection / detection and blocking of the network.
DFIR: Digital Forensics and Incident Response - digital forensics and incident response.
EVTX: Windows Event Log File Format.
CEF / LEEF: Common Event Format / Log Event Extended Format - event formats for transfer to SIEM (ArcSight / QRadar).
ECS: Elastic Common Schema - a single field scheme so that magazines from different sources can be searched together.
SPL / KQL / EQL: Splunk, Microsoft and Elastic query languages.
NTP / UTC: Network Time Protocol / Coordinated Universal Time - time synchronization / common time zone for magazines.
WORM: Write Once, Read Many - a store where the entry can no longer be changed or deleted.
NetFlow: Summary of network connections: what, with what, how much - without content.
TGT / TGS: Ticket-Granting Ticket / Ticket-Granting Service - Kerberos to apply for tickets in Windows domain.
RDP: Remote Desktop Protocol - Windows remote desktop.
SQLi / XSS: SQL injection / Cross-Site Scripting - attacks on web applications that may be detected in magazines.
PCI DSS: Payment Card Industry Data Security Standard - the security standard for the card industry.
CIS: Center for Internet Security - the organisation that publishes CIS Controls and Configuration Guidelines.
IdP: Identity Provider - a system that checks the user (Entra ID, Octa).
GeoIP: Determination of the country or city by IP address.
YAML: Text format for configuration and Sigma rules.