Logs — this is where SOC really starts
Lesson#90 of 107
in project
Theory
Endpoint
-
Windows Event Logs
-
Sysmon
-
Linux logs
-
EDR telemetry
Network
-
firewall
-
IDS/IPS
-
proxy
-
DNS
-
VPN
-
DHCP
-
NetFlow
Identity
-
Active Directory
-
authentication logs
-
Azure/Entra ID
-
MFA
-
SSO
Applications
-
web server
-
database
-
application logs