31. SOC, SIEM and Incident Response
31.2 Where Logs Live
Logs are the raw evidence. Know where each one is:
| Source | Location / how to read | What it shows |
|---|---|---|
| Linux authentication (Amazon Linux/RHEL) | /var/log/secure |
SSH logins, sudo use, failed passwords |
| Linux authentication (Ubuntu/Kali) | /var/log/auth.log |
Same as above |
| Linux system | /var/log/messages, journalctl |
Services, kernel, errors |
| Apache | /var/log/httpd/access_log, error_log |
Every web request, status codes, errors |
| Nginx | /var/log/nginx/access.log, error.log |
Same for Nginx |
| MySQL | /var/log/mysqld.log |
Failed DB logins, errors |
| Windows | Event Viewer, Security log | Logon events: 4624 success, 4625 failure, 4720 user created |
| AWS | CloudTrail, VPC Flow Logs, S3/ELB access logs (Chapter 30) | API calls, network traffic |
Quick investigation commands you already know, now used like an analyst:
# Failed SSH logins and the top attacking IPs
sudo grep "Failed password" /var/log/secure | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr | head
# Successful logins – did any attacker get in?
sudo grep "Accepted" /var/log/secure
# Who used sudo?
sudo grep "sudo:" /var/log/secure | tail
# Web attacks: SQLi/XSS patterns and 404 floods in Apache
sudo grep -Ei "union|select|<script|\.\./" /var/log/httpd/access_log | tail
sudo awk '$9==404 {print $1}' /var/log/httpd/access_log | sort | uniq -c | sort -nr | head
Ravindra Bagale's Tip
"Failed password" baghun ghabru naka – internet var pratyek server la roj hajaro attempts yetat. Khari chinta "Failed" nantar tyach IP varun "Accepted" aala tar – mhanje password guess zala. Nehmi failure nantar success shodha.
Lab
From Kali run a short Hydra attack (Chapter 22) against the Metasploitable SSH service, then log in once successfully with the right password. On Metasploitable read /var/log/auth.log and find: the Kali IP, how many failures, and the time of the successful login. Then run a Nikto scan (Chapter 20) against DVWA and find its traces in the Apache access log.