What is a security log?¶
A security log records events that a system, security product or administrator considers relevant to protecting accounts, devices, networks or data.
It may include login activity, permission changes, malware detections, blocked connections, policy violations, account lockouts and attempts to access protected resources.
Avoid this assumption: That every entry in a security log proves a security incident or malicious act. It does not.
A security log records activity according to the rules and configuration of the system that created it. Routine administration, software updates, user mistakes and legitimate testing can all produce security-related entries. Equally, malicious activity may occur without generating a record.
The value of the log depends on the event. A record might show that a connection was blocked, a file was quarantined, a policy was changed or an account failed authentication. It may contain an event code, severity, source and destination information, account, device, process, result and timestamp.
Severity is not the same as proof. A “critical” label may reflect the potential impact of the event type, not a confirmed assessment of what happened in the case. A detection may be based on a signature, threshold, reputation list or behavioural rule, each with different limitations.
Investigators should identify the exact product and component that generated the entry. Ask for the event definition, rule or policy involved, product version and relevant configuration. Establish whether the entry is a raw event, an alert or a dashboard summary.
Preserve the underlying source records and surrounding activity. Where a threat was detected, determine whether it was attempted, blocked, quarantined, executed or merely suspected. Correlate with endpoint, network, authentication and application evidence before drawing conclusions about intent or attribution.
Operational takeaway¶
A security log records activity considered security-relevant, but it does not automatically prove an incident, malicious intent, successful compromise or the identity of an offender.