Heartbeat AI | Enterprise Automation

Digital Forensics & Auditing

Reading the breadcrumbs: Master Windows Event Viewer, Syslog, and SIEM logic.

In a Security+ scenario, you are rarely the one watching the attack live. Instead, you are the investigator arriving after the alarm sounds. To find the "who, what, and when," you must be able to parse System Logs, Application Logs, and Security Logs across different platforms.

1. Windows Event Viewer

On Windows, logs are centralized. For the exam, focus on the Security Log, which contains Audit Events.

Event ID	Meaning	Security Significance
4624	An account was successfully logged on.	Check for logins at 3:00 AM or from odd locations.
4625	An account failed to log on.	Multiple 4625s in a row = Brute Force Attack.
4720	A user account was created.	Check if an attacker created a "backdoor" admin account.

2. Linux Logging: /var/log/

Linux systems store logs in plain text files. To be a guru, you must know where to find the "smoking gun" files.

/var/log/auth.log

Used in Debian/Ubuntu to track all authentication attempts (SSH logins, sudo usage, etc.).

grep "Failed password" /var/log/auth.log

/var/log/secure

The Red Hat/CentOS equivalent to auth.log. Vital for auditing server access.

3. SIEM & Log Aggregation

A **SIEM (Security Information and Event Management)** like Splunk or ELK collects logs from every device and correlates them.

Aggregation: Gathering logs from firewalls, servers, and routers into one place.
Correlation: Linking a "Failed Login" on a server with a "Port Scan" detected by the firewall.
Retention: Keeping logs for 1-7 years for legal and compliance reasons.

4. HTTP Status Codes in Logs

When reviewing web logs (Apache/Nginx), the status code tells the story:

Code Range	Meaning	Security Perspective
200-299	Success	The attacker successfully reached the page.
403	Forbidden	Attacker tried to access a restricted directory.
404	Not Found	A massive spike in 404s suggests a Directory Brute Force scan.
500-599	Server Error	Could indicate a SQL Injection or Buffer Overflow attempt.

Mastering Logs