Log Analysis and Event IDs
Analysis questions hand you a log line and ask what happened. Knowing which event ID means what, and which file to look in, is most of the work.
Log Analysis and Event IDs · firsttry.app/cheatsheets/log-analysis · original reference written from published exam objectives. Not affiliated with any certification body.
Windows security event IDs
| Event ID | What it means |
|---|---|
| 4624 | Successful logon |
| 4625 | Failed logon. Repeated means brute force or spraying |
| 4634 / 4647 | Logoff, and user-initiated logoff |
| 4648 | Logon using explicit credentials. Often lateral movement |
| 4672 | Special privileges assigned. An admin logon |
| 4688 | New process created. The command line is here if auditing is on |
| 4720 | User account created |
| 4726 | User account deleted |
| 4728 / 4732 | Member added to a global or local group |
| 4740 | Account locked out |
| 4768 / 4769 | Kerberos TGT and service ticket requested |
| 1102 | Audit log cleared. Almost always worth investigating |
| 7045 | New service installed. Common persistence |
Windows logon types
| Type | Meaning |
|---|---|
| 2 | Interactive. Someone at the keyboard |
| 3 | Network. File share or similar |
| 4 | Batch. Scheduled task |
| 5 | Service |
| 7 | Unlock |
| 8 | Network cleartext. Credentials sent in the clear |
| 9 | New credentials. RunAs with network credentials |
| 10 | Remote interactive. RDP |
| 11 | Cached interactive. No domain controller reachable |
Linux log locations
| Path | What is in it |
|---|---|
| /var/log/auth.log | Authentication, sudo and SSH (Debian family) |
| /var/log/secure | Same, on the Red Hat family |
| /var/log/syslog | General system messages |
| /var/log/messages | General system messages (Red Hat family) |
| /var/log/kern.log | Kernel messages |
| /var/log/audit/audit.log | auditd records |
| /var/log/faillog | Failed login attempts |
| ~/.bash_history | Shell history. Often cleared by an attacker |
| journalctl | systemd journal, where these are unified |
Investigation questions to ask of a log
| Question | What answers it |
|---|---|
| Who | Account name and source IP on the logon event |
| When | Timestamp, and whether it is inside working hours |
| From where | Source workstation and network segment |
| What ran | Process creation events with the command line |
| Did it persist | New service, scheduled task or run key |
| Did it spread | Explicit credential logons, remote logons on other hosts |
| Did they clean up | Audit log cleared, history truncated, timestamps altered |
Now test yourself
Memorizing a table is a start. Practice questions are what make it stick, and every answer carries the full explanation.