LogRhythm

Log Source

Answer explanation

This is any system (application, device, etc) that can communicate with the network and provides log messages (data).

log message

Answer explanation

This is a record of activity on a network. A log may include a user logon, system shutdown, application installation authentication failure, and more.

raw logs

Answer explanation

These logs are filled with unorganized data that is time-consuming for an analyst to locate and read making them very impractical.

Data collection

Answer explanation

This is the process of collecting raw log messages from log sources.

Give three Windows Security Log examples:

Answer explanation

1) Account logon 2) Account management 3) Directory service access

Give three Windows System Log examples:

Answer explanation

1) Driver Failure 2) IP Address Conflicts 3) System Shutdown and Start-up

Give three Windows Application Log examples:

Answer explanation

1) Application crashes and hangs 2) SSL Certificate loaded 3) Installation failure

Give three Linux Critical Log examples:

Answer explanation

1) Var/log/message 2) Var/log/auth.log 3) Var/log/secure

Detection

Answer explanation

This is all about using the SIEM to detect a problem in your environment.

What must happen first to enable Detection?

Answer explanation

Data collection