31. SOC, SIEM and Incident Response
31.2 Where Logs Live
Logs are the raw evidence. Know where each one is:
| Source | Location / how to read | What it shows |
|---|---|---|
| Linux authentication (Amazon Linux/RHEL) | /var/log/secure |
SSH logins, sudo use, failed passwords |
| Linux authentication (Ubuntu/Kali) | /var/log/auth.log |
Same as above |
| Linux system | /var/log/messages, journalctl |
Services, kernel, errors |
| Apache | /var/log/httpd/access_log, error_log |
Every web request, status codes, errors |
| Nginx | /var/log/nginx/access.log, error.log |
Same for Nginx |
| MySQL | /var/log/mysqld.log |
Failed DB logins, errors |
| Windows | Event Viewer, Security log | Logon events: 4624 success, 4625 failure, 4720 user created |
| AWS | CloudTrail, VPC Flow Logs, S3/ELB access logs (Chapter 30) | API calls, network traffic |
Quick investigation commands you already know, now used like an analyst:
# Failed SSH logins and the top attacking IPs
sudo grep "Failed password" /var/log/secure | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr | head
# Successful logins – did any attacker get in?
sudo grep "Accepted" /var/log/secure
# Who used sudo?
sudo grep "sudo:" /var/log/secure | tail
# Web attacks: SQLi/XSS patterns and 404 floods in Apache
sudo grep -Ei "union|select|<script|\.\./" /var/log/httpd/access_log | tail
sudo awk '$9==404 {print $1}' /var/log/httpd/access_log | sort | uniq -c | sort -nr | head
Ravindra Bagale's Tip
Don't panic when you see "Failed password" – every server on the internet gets thousands of attempts every day. The real worry is when "Accepted" appears from the same IP after the "Failed" ones – that means the password was guessed. Always look for a success after failures.
Ravindra Bagale's Tip – मराठी
"Failed password" बघून घाबरू नका – internet वर प्रत्येक server ला रोज हजारो attempts येतात. खरी चिंता "Failed" नंतर त्याच IP वरून "Accepted" आला तर – म्हणजे password guess झाला. नेहमी failure नंतर success शोधा.
Ravindra Bagale's Tip – हिंदी
"Failed password" देखकर घबराओ मत – internet पर हर server को रोज़ हज़ारों attempts आते हैं. असली चिंता तब है जब "Failed" के बाद उसी IP से "Accepted" आए – मतलब password guess हो गया. हमेशा failure के बाद success ढूँढो.
Lab
From Kali run a short Hydra attack (Chapter 22) against the Metasploitable SSH service, then log in once successfully with the right password. On Metasploitable read /var/log/auth.log and find: the Kali IP, how many failures, and the time of the successful login. Then run a Nikto scan (Chapter 20) against DVWA and find its traces in the Apache access log.