Typorithm · medium

Logging & SIEM

logging-siemsecuritysiemloggingdetection

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Logging & SIEM

Blue Team & SOC

Centralized logging feeds a SIEM (Splunk, ELK, Sentinel) that correlates events across systems to detect attacks. grep and journalctl read local logs; failed logins and "invalid user" lines flag brute force or recon. Log integrity and retention matter for investigations.

Defenders start with logs. On Linux, /var/log/auth.log (and systemd's journal via journalctl) records authentication events, so grep "Failed password" surfaces rejected logins and grep -i "invalid user" surfaces attempts against accounts that do not exist.

Watching one file with tail -f works for a single host, but real environments forward logs to a SIEM — Splunk, ELK, or Microsoft Sentinel. The SIEM ingests events from every system and correlates them, so a brute force spread across many hosts becomes one alert.

Bursts of failed logins or invalid-user lines signal brute force or reconnaissance. For the logs to be trustworthy in an investigation, you also need integrity (tamper-resistant storage) and retention (keeping them long enough to look back).

A SIEM centralizes and correlates logs across systems.

Failed password / invalid user lines signal brute force or recon.

Log integrity and retention make investigations possible.

grep "Failed password" /var/log/auth.log
journalctl -u sshd --since "1 hour ago"
tail -f /var/log/auth.log | grep -i "invalid user"
# ship logs to a SIEM (Splunk/ELK)

Read the implementation

Connect each part of the code to the concept before you type.

1. Find failed logins

Failed password lines in auth.log mark rejected SSH logins — clusters of them signal a brute-force attempt.

grep "Failed password" /var/log/auth.log

2. Query the journal

journalctl reads systemd's journal; -u scopes to the sshd unit and --since bounds the time window.

journalctl -u sshd --since "1 hour ago"

3. Follow live

tail -f streams new log lines as they are written, so you watch activity in real time.

tail -f /var/log/auth.log

4. Spot recon

invalid user lines mean a login tried an account that does not exist — a hallmark of automated recon or brute force.

grep -i "invalid user"

5. Centralize

Forwarding logs to a SIEM lets you correlate events across many hosts instead of grepping one file at a time.

# ship logs to a SIEM (Splunk/ELK)

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.