Internship
Student login
← SOC & SIEM learning path
SOC & SIEM · Module 2 of 10

Logs and data sources

Collect the right logs for visibility.

📖 Key ideas

  1. Sources: firewalls, endpoints, servers, cloud, identity, email, DNS, proxies.
  2. Windows Event Logs and Linux syslog/journald.
  3. Normalise logs into common fields (time, user, host, action).
  4. Synchronise clocks with NTP.
  5. Set retention based on compliance and investigation needs.
💡 Real-life example: Logs are diary entries from every device; without them, investigators work blind.
Log sourceSystem producing logs
SyslogStandard logging protocol
NormalisationMapping logs to common fields
NTPNetwork Time Protocol