End Device Logs In Cybersecurity: The Various Types

• Application logs – These contain events logged by various applications.
• System logs – These include events regarding the operation of drivers, processes, and hardware.
• Setup logs – These record information about the installation of software, including Windows updates.
• Security logs – These record events related to security, such as logon attempts and operations related to file or object management and access.
• Command-line logs – Attackers who have gained access to a system, and some types of malware, execute commands from the command-line interface (CLI) rather than a GUI. Logging command line execution will provide visibility into this type of incident.

Various logs can have different event types. Security logs consist only of audit success or failure messages. On Windows computers, security logging is carried out by the Local Security Authority Subsystem Service (LSASS), which is also responsible for enforcing security policies on a Windows host. LSASS runs as lsass.exe. It is frequently faked by malware.

It should be running from the Windows System32 directory. If a file with this name, or a camouflaged name, such as 1sass.exe, is running or running from another directory, it could be malware.

Windows Events are identified by ID numbers and brief descriptions. An encyclopedia of security event IDs, some with additional details, is available from Ultimate Windows Security on the web.

The table explains the meaning of the five Windows host log event types.

The full format of a Syslog message that is seen on the network has three distinct parts, as shown in the figure.

• PRI (priority)
• HEADER
• MSG (message text)

The PRI consists of two elements, the Facility and Severity of the message, which are both integer values. The Facility consists of broad categories of sources that generated the message, such as the system, process, or application. The Facility value can be used by logging servers to direct the message to the appropriate log file. The Severity is a value from 0-7 that defines the severity of the message.

• Log collection – Event records from sources throughout the organization provide important forensic information and help to address compliance reporting requirements.
• Normalization – This maps log messages from different systems into a common data model, enabling the organization to connect and analyze related events, even if they are initially logged in different source formats.
• Correlation – This links logs and events from disparate systems or applications, speeding detection of and reaction to security threats.
• Aggregation – This reduces the volume of event data by consolidating duplicate event records.
• Reporting – This presents the correlated, aggregated event data in real-time monitoring and long-term summaries, including graphical interactive dashboards.
• Compliance – This is reporting to satisfy the requirements of various compliance regulations.

A popular SIEM is Splunk, which is made by a Cisco partner. The figure shows a Splunk Threat Dashboard. Splunk is widely used in SOCs. Another popular SIEM solution is Security Onion with ELK, which consists of the integrated Elasticsearch, Logstash, and Kibana applications. Security Onion includes other open-source network security monitoring tools.