Log Analysis Mastery

Logs are the evidence of what happened on systems and networks. This roadmap teaches you to read, correlate and explain logs like an investigator. SIEM basics help but aren't required.

• Have access to sample Windows and Linux logs
• Install a log viewer or small SIEM
• Plan your study time

• CyberA4U Academy — courses

Different logs answer different questions: authentication, endpoint, network, DNS, proxy, application and cloud audit logs.

• List log types and what each reveals
• Know where each is stored
• Identify gaps in coverage

Tools & tech: Analysis

• NIST SP 800-92 — Guide to Computer Security Log Management

Normalization maps different log formats to common field names, so one query works across sources.

• Understand schemas such as ECS
• Map raw fields to normalized fields
• Handle missing and inconsistent data

Tools & tech: Analysis

• Elastic Common Schema (ECS) reference

Correlation depends on accurate time. Time zones, clock drift and different formats cause many investigation mistakes.

• Normalize timestamps to UTC
• Detect clock drift
• Keep systems synchronized with NTP

Tools & tech: Analysis

• RFC 5905 — Network Time Protocol Version 4

Start from a question ("did this account log in from somewhere unusual?"), then find the data that confirms or rejects it — instead of scrolling through everything.

• Write testable hypotheses
• Choose data sources to test them
• Record conclusions and evidence

Tools & tech: Analysis

• MITRE ATT&CK — Getting started

Correlation links events across sources: a phishing click, then a new process, then an outbound connection. Common patterns include sequences, thresholds and rare events.

• Correlate by user, host and time
• Use thresholds and sequences
• Find rare values

Tools & tech: Analysis

• Sigma — Rules basics

Windows Security, Sysmon and PowerShell logs reveal logons, process creation, service changes and scripts.

• Know key event IDs (4624, 4625, 4688, 7045, 4104)
• Use Sysmon for richer data
• Spot suspicious patterns

Tools & tech: Analysis

• Microsoft — Appendix L: Events to monitor

Linux auth logs, journald and auditd show logins, sudo use, process execution and file changes.

• Read auth.log and journal entries
• Use auditd rules
• Spot suspicious logins and commands

Tools & tech: Analysis

• journalctl(1) — Linux manual page
• auditd(8) — Linux manual page

Proxy and DNS logs show where hosts connect — useful for spotting malicious domains, tunneling and command-and-control.

• Analyze DNS queries for suspicious domains
• Spot unusual volumes or long domain names
• Review proxy categories and user agents

Tools & tech: Analysis

• Zeek — dns.log

Cloud audit logs record every API call: who did what to which resource, from where.

• Read CloudTrail, Azure Activity and Google Audit Log events
• Identify risky actions
• Trace an attacker's API activity

Tools & tech: Analysis

• AWS CloudTrail User Guide

The goal of analysis is a clear story: what happened, in what order, with evidence for each step and honest uncertainty.

• Build a timeline from multiple sources
• Support each claim with log evidence
• State confidence and gaps

Tools & tech: Analysis

• NIST SP 800-61 Rev. 3 — Incident Response Recommendations

Scripts and notebooks speed up repetitive parsing, enrichment and summaries so you can focus on reasoning.

• Parse logs with Python
• Enrich with lookups
• Summarize large datasets

Tools & tech: Analysis

• Python — re module

Public datasets such as Splunk's Boss of the SOC let you practice realistic investigations safely.

• Work through a full scenario
• Answer investigation questions with evidence
• Compare your answers with the official solutions

Tools & tech: Analysis

• Splunk — Boss of the SOC v3 dataset

Check that you can investigate an incident across multiple log sources and explain it clearly.

• Normalize and correlate logs
• Hunt in Windows, Linux, network and cloud logs
• Write an evidence-based narrative

• CyberA4U CTF Arena — practice challenges

You can now analyze logs like an investigator. Continue with SOC Analyst, SIEM Engineering or Detection Engineering.

• Keep practicing with public datasets
• Choose your next roadmap
• Share an investigation write-up

• CyberA4U CTF Arena — practice challenges