Intermediate level · Module 4: Logging and Detecting Suspicious Activity · Lesson 1 of 3
Log Sources
Know where evidence of activity is recorded.
In this lesson you will
- List useful log sources
- Make sure important logs are turned on and kept
Key concepts
event logssign-in logsfirewall logsretention
The lesson
Logs record what happened: sign-ins, failures, changes to accounts, blocked connections. Without logs, incidents are invisible and investigations impossible.
Useful sources for a small office: cloud email and file sign-in logs, Windows security events, router and firewall logs and antivirus alerts.
Check that logging is on and kept long enough to investigate — often at least 90 days — and protect logs from deletion.
Step by step
- List the office's log sources.
- Check each is enabled.
- Check retention periods.
- Record where each can be viewed.
Practice activity
Create a log source inventory for the lab office.
Expected result: An inventory with status and retention for each source.
Check your understanding
-
Why are logs essential in an incident?
Show answer
They show what happened and when.
-
Name two log sources in a small office.
Show answer
Cloud sign-in logs, Windows security events, router or antivirus logs.
Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.