Log Sources Overview

Why Logs Are the Foundation and What to Collect

Alerts are signals — they tell you something happened. Logs tell you what exactly, when, where, and how. Without logs, an alert is just noise. Every SOC investigation starts and ends in the logs.

The cardinal rule: log everything, filter later. It is far cheaper to store logs you don’t need than to discover you didn’t log something you do.

Below is a source-by-source breakdown of what each log type captures, the key fields and Event IDs to know, and how analysts use each source.

Windows Security Event Log

The most important single log source for Windows environments. Captures authentication, privilege use, process creation, and policy changes.

Key Event IDs

Where to find it: Applications and Services Logs > Microsoft > Windows > Security (or forwarded to Windows Event Forwarding collector)

Analyst note: Enable CommandLine logging in 4688 events via GPO (Administrative Templates > System > Audit Process Creation > Include command line in process creation events). This is not enabled by default — and it is the single highest-value log setting you can enable.

Sysmon

Microsoft Sysinternals’ Sysmon sits on Windows endpoints and provides granular telemetry that the built-in security log does not capture. It is the de facto standard for endpoint visibility.

Key Event IDs

Where to find it: Applications and Services Logs > Microsoft > Windows > Sysmon/Operational

Analyst note: Sysmon Event ID 3 (network connections) and Event ID 22 (DNS queries) are the most valuable for network-based threat detection. Ensure your Sysmon config enables both. The default SwiftOnSecurity configuration is an excellent starting point.

Firewall Logs

Firewall logs record allowed and blocked network connections at the network perimeter and between network segments.

What They Capture

• Source IP/Port and Destination IP/Port
• Protocol (TCP, UDP, ICMP)
• Action (Allow, Deny, Drop, Reset)
• Timestamp and Interface
• Packet size and TCP flags (on some platforms)

Analyst Use Cases

• Outbound connection monitoring: Allowed outbound connections to unknown IPs. Cross-reference with threat intelligence feeds.
• Blocked traffic analysis: Dropped inbound connections are normal (internet noise), but blocked outbound traffic from an internal host to an external IP means a policy violation or compromised host attempting C2.
• Port scan detection: High volume of denied connections from a single source IP targeting multiple ports = scanning activity (T1046).
• Data exfiltration: Unusually large outbound packets or persistent outbound connections to a single external IP at regular intervals.

Cloud Firewall Examples

AWS Security Group logs (VPC Flow Logs):

• srcaddr, dstaddr, dstport, protocol, action (ACCEPT/REJECT), bytes, packets, start, end
• Query: action = REJECT and dstport not in (443, 80, 53) = unusual blocked traffic

Azure NSG Flow Logs:

• FlowDirection (I=inbound, O=outbound), FlowStatus (A=allowed, D=denied), SourcePort, DestinationPort
• Query: FlowStatus = D and FlowDirection = O = outbound traffic blocked

GCP VPC Flow Logs:

• Similar structure. dest_port, src_ip, dest_ip, bytes_sent, packets

DNS Query Logs

DNS logs are the most underappreciated detection source in most SOCs. Every connection starts with a DNS query. If you can capture all DNS queries from all endpoints, you have a baseline of every domain being accessed.

What They Capture

• Client IP — who asked
• Query name — what domain
• Query type — A, AAAA, CNAME, MX, TXT, ANY
• Response IP — what the domain resolved to
• Response code — NXDOMAIN, NOERROR, SERVFAIL
• Timestamp

Analyst Use Cases

• DGAs (Domain Generation Algorithms): Random-looking subdomain or domain names (e.g., a7x9p2z.malware-domain.info). High query-to-NXDOMAIN ratio indicates DGA-based C2 (T1568.002).
• DNS tunneling: High volume of TXT or CNAME queries with subdomains > 30 characters. Especially suspicious when it comes from a single host (T1572).
• Newly observed domains (NODs): Domains registered < 30 days ago that appear in your DNS logs. A leading indicator of phishing sites and C2 infrastructure.
• Beaconing: Regular query intervals (every 60 minutes on the dot to the same domain). Time-between-queries (TBQ) analysis works well on DNS logs.
• Fast flux: Rapidly changing A records for a single domain — the domain resolves to different IPs in rapid succession, indicating fast-flux botnet infrastructure.

Example Indicators

Proxy/Web Filter Logs

Web proxy logs record all HTTP/HTTPS traffic passing through the organization’s proxy. They provide visibility into web-based attacks, policy violations, and C2 traffic.

What They Capture

• Source IP and username (if authenticated proxy)
• URL (full URL for HTTP, hostname for HTTPS)
• User-Agent string
• HTTP method and status code
• Content type and bytes transferred
• Block/Action (allowed, blocked, warned)

Analyst Use Cases

• C2 traffic: Beacons to known C2 infrastructure. Regular intervals, consistent payload sizes, unusual User-Agents.
• Phishing URL visits: Users clicking links in phishing emails. The proxy log confirms the user visited the site.
• Data exfiltration: Large POST requests to external domains (especially cloud storage/file sharing).
• Policy violations: Tor traffic, anonymizer sites, unauthorized cloud services (shadow IT).
• User-Agent anomalies: Empty User-Agent, non-browser User-Agent, or User-Agent matching an outdated browser version = automation tooling or malware.

EDR Telemetry

Endpoint Detection and Response (EDR) logs combine traditional event logging, Sysmon-like telemetry, behavioral analytics, and network visibility into a single platform.

What They Capture

• Process tree — every process, parent process, child process, command line
• File operations — create, modify, delete, rename with full paths
• Registry operations — key create, modify, delete
• Network connections — per-process outbound connections with full IP/port detail
• Memory access — process handle operations, injection detection
• Script execution — PowerShell script block logging, VBS macro detection
• User behavior — logins, privilege changes, authentication patterns

Analyst Use Cases

• Process ancestry analysis: winword.exe → cmd.exe → powershell.exe = potential macro-based malware (a “living off the land” chain — T1204.002).
• Remote thread creation: explorer.exe creating a remote thread in svchost.exe = process injection.
• LSASS access alerts: EDR alerting on any process opening a handle to LSASS.
• Beaconing detection: Network connections at regular intervals with consistent payload sizes over a sustained period.
• Fileless malware detection: PowerShell running encoded commands without a parent that justifies scripting.

Cloud Audit Logs

AWS CloudTrail

Records all API calls made to AWS services.

Key events:

• ConsoleLogin — AWS console login (geolocation, MFA status, access key vs. password)
• CreateAccessKey — New access key creation. Could be attacker establishing persistence (T1098).
• CreateUser / CreateRole — Unexpected IAM resource creation = persistence.
• CreateInstance / RunInstances — New compute resource launched (cryptocurrency mining, C2 infrastructure).
• ModifySecurityGroup / AuthorizeSecurityGroupIngress — Security group change opening ports.
• PutBucketPolicy / GetBucketAcl — S3 access policy changes.
• AssumeRole — Cross-account role assumption.
• KMS* operations — Cryptographic operations. Suspicious if from a user who never uses KMS normally.

Azure Activity Log

Records control-plane operations on Azure resources.

Key events:

• Microsoft.Network/networkSecurityGroups/securityRules/write — NSG rule modification
• Microsoft.Compute/virtualMachines/extensions/write — VM extension installation (custom script extension = persistence)
• Microsoft.Authorization/roleAssignments/write — RBAC role assignment change
• Microsoft.ManagedIdentity/userAssignedIdentities/assign — Managed identity assignment for privilege escalation

GCP Cloud Audit Logs

• google.iam.admin.v1.CreateServiceAccount or google.iam.admin.v1.CreateKey — Service account key creation outside of automation pipelines.
• compute.instances.insert — Unexpected VM creation.
• storage.buckets.setIamPolicy — Bucket permission changes.

Log Correlation — Putting It All Together

A single log source is rarely enough. The power comes from correlation:

Related

• Active Directory Basics — covers the active directory basics concepts
• Common Ports and Protocols — covers the common ports and protocols concepts
• Cloud Threats — Credential Theft, IMDS Abuse, Hijacking, Privilege Escalation — detection and response for T1525, T1552, T1613 techniques
• Container and Kubernetes Threats — detection and response for T1611, T1525, T1574.002 techniques
• Golden Ticket Attack — detection and response for T1558.001 techniques

Sources

• Microsoft Windows Security Log Encyclopedia
• Sysmon Documentation
• MITRE ATT&CK T1654
• SwiftOnSecurity Sysmon Configuration
• AWS CloudTrail Documentation
• Azure Activity Log