Ravi Sir's Cyber Security Cards › Interview Cards
What logs matter most in a typical incident?
What logs matter most in a typical incident? Firewall, EDR/endpoint, authentication (AD/VPN), DNS, email gateway, web proxy, and critical server logs. In cloud, add CloudTrail and control-plane logs. “I name the big log sources and say cloud adds CloudTrail.” Knowing where to look first saves precio
Read card text
What this card says
Short answer
Firewall, EDR/endpoint, authentication (AD/VPN), DNS, email gateway, web proxy, and critical server logs.
Example
In cloud, add CloudTrail and control-plane logs.
Say it in the interview
“I name the big log sources and say cloud adds CloudTrail.”
Why it matters
Knowing where to look first saves precious time in an incident.
Learn more in the lesson: 47.4 SOC Analyst Round – SIEM, Triage, MITRE