Ravi Sir's Cyber Security Cards › Comparison Cards
Covering Tracks vs Log Integrity – Blue Wins
Covering Tracks vs Log Integrity – Blue Wins Covering tracks : an attacker deletes logs or changes times to hide. Log integrity : the defender keeps logs safe so they cannot be changed. Send a copy of every log to a separate server, like a SIEM (central log system), right away. The attacker can wipe
Read card text
What this card says
What each one is
Covering tracks: an attacker deletes logs or changes times to hide.
Log integrity: the defender keeps logs safe so they cannot be changed.
How defenders win
Send a copy of every log to a separate server, like a SIEM (central log system), right away.
The attacker can wipe the local log, but not the copy already sent.
Example
An attacker clears fast.log on a sensor.
The same alerts are already stored on the SIEM in another city.
Common mistake
“Local logs are enough” is wrong. Clearing logs is one of the first things attackers learn.
Also alert when a log source goes silent.
| Red team (attacker) does | Blue team (defender)… |
|---|---|
| rm / truncate local IDS log | Remote syslog; alert on log volume drop to zero |
| Sets clock back to confuse IR | chrony + alert on time step; compare SIEM ingest time |
| Stops suricata service | systemd/service monitor; missing-heartbeat in SIEM |
Learn more in the lesson: 42.7 Covering Tracks vs Log Integrity – Blue Wins