SOC & incident response · Lesson 1 of 5
Read a log like an investigator
Logs are observations about activity. Useful security events help you reconstruct what happened, but they need context and protection.
A log you can investigate
One synthetic sign-in event, shown as labeled fields.
- When09:45:02 UTC
Retain the time zone.
- Who / whereanalyst01 · 203.0.113.24
Link the identity and source to the event.
- What / resultSign-in · failed
Describe the action and outcome.
- Keep outPasswords and access tokens
Do not create a new credential leak in the log.
Read the visualWhat is missing from a record that only says “login failed”?
The time context, account, source, and system or application needed to investigate the event.
Capture meaningful context
Look for when, where, who, and what: timestamps, the system, the identity, the action, and the outcome.
Protect the record
Restrict access and guard against unauthorized changes. Logs can contain sensitive information.
Do not create another leak
Avoid recording passwords, access tokens, and other secrets. More data is not always better data.
Put it in context
A fictional record says “login failed.” A record that also includes the account, time zone, source, application, and result gives an investigator more useful context.
Good evidence is relevant, interpretable, and protected.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.