Security Log Analysis Guide

# Failed SSH login attempts
grep "Failed password" /var/log/auth.log
grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn

# Successful SSH logins
grep "Accepted password\|Accepted publickey" /var/log/auth.log

# sudo usage
grep "sudo:" /var/log/auth.log

# New user creation
grep "useradd\|adduser" /var/log/auth.log

# Check login history
last -a | head -50
lastb | head -50           # Failed logins (requires root)

# Auditd - track file access
ausearch -f /etc/passwd
ausearch -k passwd_changes  # If rule configured

# Recent cron jobs
grep "CMD" /var/log/cron.log | tail -50

# Check for suspicious bash history
cat /home/*/.bash_history 2>/dev/null
cat /root/.bash_history 2>/dev/null

# Find recently modified files
find /tmp /var/tmp /dev/shm -newer /proc -type f 2>/dev/null
find / -mtime -1 -type f 2>/dev/null | grep -v proc

# Apache Combined Log Format
192.168.1.100 - admin [26/Aug/2026:14:32:01 +0000] "GET /admin/config.php HTTP/1.1" 200 4521 "https://target.com" "Mozilla/5.0"

# Fields:
# %h   - Client IP address
# %l   - Ident (usually -)
# %u   - Authenticated username
# [%t] - Timestamp
# "%r" - Request line (method, URI, protocol)
# %>s  - HTTP status code
# %b   - Response size in bytes
# "%{Referer}" - Referrer URL
# "%{User-Agent}" - User agent string

# Nginx default log format
$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"

# Top requesting IPs
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -20

# HTTP 4xx and 5xx errors
awk '$9 ~ /^[45]/' access.log | awk '{print $1, $7, $9}' | sort | uniq -c | sort -rn

# SQL injection attempts
grep -i "select\|union\|insert\|drop\|1=1\|or%20\|' or" access.log

# XSS attempts
grep -i "script\|onerror\|onload\|javascript\|alert(" access.log

# Directory traversal
grep -i "\.\./\|%2e%2e\|%252e" access.log

# Scanning tools detection
grep -i "nikto\|sqlmap\|nmap\|masscan\|dirbuster\|gobuster\|burpsuite" access.log

# Large response sizes (potential data exfiltration)
awk '{if ($10 > 1000000) print $0}' access.log

# Requests to sensitive files
grep -i "\.env\|wp-config\|config\.php\|\.git\|passwd\|shadow" access.log

# POST requests (form submissions, potential attacks)
grep '"POST' access.log | awk '{print $1, $7}' | sort | uniq -c | sort -rn

# Internal host scanning - high deny count from single source
action: "deny" AND src_ip: 10.0.0.0/8
| stats count by src_ip, dst_port
| where count > 100

# Outbound connections to unusual ports
dst_port: (4444 OR 1337 OR 8888 OR 9001 OR 31337) AND action: "allow"

# Large outbound data transfers
action: "allow" AND direction: "outbound" AND bytes_sent > 10000000

# Connections to known malicious IP ranges (enrich with threat intel)
dst_ip: [IOC_LIST] AND action: "allow"

# Internal to internal on admin ports (lateral movement)
src_ip: 10.0.0.0/8 AND dst_ip: 10.0.0.0/8 
AND dst_port: (22 OR 3389 OR 445 OR 5985 OR 5986)

# Beaconing detection - regular interval connections
action: "allow" AND dst_ip: [external]
| bucket @timestamp 1m
| stats count by dst_ip, _bucket
| where stddev(count) < 2  # Very regular = suspicious

# Top DNS queries
zeek-cut query < dns.log | sort | uniq -c | sort -rn | head -20

# DNS queries with NXDOMAIN (failed - possible DGA/C2)
zeek-cut query rcode < dns.log | grep "NXDOMAIN" | awk '{print $1}' | sort | uniq -c | sort -rn

# Long HTTP connections (possible C2 beaconing)
zeek-cut id.orig_h id.resp_h id.resp_p duration < conn.log | \
  awk '$4 > 3600' | sort -k4 -rn | head -20

# Large outbound data transfers
zeek-cut id.orig_h id.resp_h orig_bytes resp_bytes < conn.log | \
  awk '$3 > 10000000 || $4 > 10000000' | sort -k3 -rn

# Unique user agents in HTTP
zeek-cut user_agent < http.log | sort -u | grep -iv "mozilla\|chrome\|safari"

# Files downloaded - check hashes
zeek-cut filename md5 sha256 mime_type < files.log | grep -v "^-"

# SSL certificates - self-signed or unusual issuers
zeek-cut server_name issuer < ssl.log | grep -iv "Let's Encrypt\|DigiCert\|Comodo"

# Password spray - many accounts, few attempts each
# EventID 4625 - Failed logon
EventID: 4625 AND LogonType: 3
| stats count by TargetUserName, IpAddress
| where count < 5  # Low per-account attempts
| stats count by IpAddress
| where count > 20  # High number of different accounts
# Result: Single IP trying many usernames = spray

{
  "eventVersion": "1.08",
  "userIdentity": {
    "type": "IAMUser",
    "userName": "john.doe",
    "arn": "arn:aws:iam::123456789:user/john.doe"
  },
  "eventTime": "2026-08-26T14:32:01Z",
  "eventSource": "s3.amazonaws.com",
  "eventName": "GetObject",
  "sourceIPAddress": "203.0.113.5",
  "requestParameters": {
    "bucketName": "sensitive-data-bucket",
    "key": "customer-data.csv"
  },
  "responseElements": null,
  "errorCode": null
}

# Filebeat configuration for Windows Event Logs
filebeat.inputs:
  - type: winlog
    event_logs:
      - name: Security
        ignore_older: 72h
      - name: Microsoft-Windows-Sysmon/Operational
      - name: Microsoft-Windows-PowerShell/Operational

# Logstash filter pipeline - parse and enrich
filter {
  if [winlog][channel] == "Security" {
    mutate {
      add_field => { "log_type" => "windows_security" }
    }
  }
  # GeoIP enrichment
  geoip {
    source => "source.ip"
    target => "source.geo"
  }
  # Threat intel enrichment
  translate {
    field => "source.ip"
    destination => "threat.indicator"
    dictionary_path => "/etc/logstash/threat_intel.yml"
  }
}