log

Blue Team and Defense

A file or stream where software records what happened: who signed in, which file was opened, which connection was refused. Logs are the raw material of defense, because an attack nothing recorded is an attack nobody can prove.

Related terms

SIEM

telemetry

Appears in(155)

What PowerShell Is and Why It MattersPowerShell
Cmdlets, Parameters, and Getting HelpPowerShell
IP Addressing and SubnettingNetworking Foundations
TCP, UDP, and PortsNetworking Foundations
Arrays, Ranges, and HashtablesPowerShell
Comparisons, if, and LoopsPowerShell
Filesystem and PermissionsLinux for Security
Text Processing: grep, awk, sedLinux for Security
Reading and Writing FilesPython Deep Dive
Network Automation and Infrastructure as CodeNetworking Deep Dive
Lists: Many Values in OneIntro to Python
What Version Control IsVersion Control with Git
Recon Methodology and Attack SurfaceRecon and Scanning
HTTP Methods and Status CodesBackends and APIs
Your First RepositoryVersion Control with Git
Host DiscoveryRecon and Scanning
Branching and MergingVersion Control with Git
Port Scanning Deep DiveRecon and Scanning
GitHub and Working With OthersVersion Control with Git
Service and Version DetectionRecon and Scanning
Authentication and API SecurityBackends and APIs
AI Agents and ToolsBuilding with AI
Undoing MistakesVersion Control with Git
Subdomain and Content EnumerationRecon and Scanning
Coordinate Transforms with pyproj and GeoPandasGIS Programming with Python
Scripting a Real GIS Pipeline End to EndGIS Programming with Python
HTTP FundamentalsWeb and HTTP
How Web Apps WorkWeb and HTTP
Cookies, Sessions, and AuthWeb and HTTP
Intercepting ProxiesWeb and HTTP
The OWASP Top 10Web and HTTP
Threat Modeling Your LifeDigital Self-Defense
Injection and XSSVulnerabilities and Exploitation
Modern Vector Tiles with MapLibre GLWeb Mapping
Hashing and Password SecurityVulnerabilities and Exploitation
Browsing PrivatelyDigital Self-Defense
Linux Privilege EscalationVulnerabilities and Exploitation
Securing Your Devices and MessagesDigital Self-Defense
Your Privacy ToolkitDigital Self-Defense
Approaching a TargetCTF Methodology
From Foothold to RootCTF Methodology
TLS in PracticeCryptography
How Passwords Are StoredPassword Attacks
Online vs Offline AttacksPassword Attacks
Active Directory FundamentalsActive Directory
Common AD AttacksActive Directory
The Human Attack SurfaceSocial Engineering
Phishing and PretextingSocial Engineering
Defending PeopleSocial Engineering
Windows Architecture and ProcessesWindows Fundamentals
Windows Permissions and PrivilegesWindows Fundamentals
PowerShell for SecurityWindows Fundamentals
Windows Event LogsWindows Fundamentals
Windows Networking and SMBWindows Fundamentals
Python Crash Course for HackersPython for Security
Talking HTTP with PythonPython for Security
Sockets and NetworkingPython for Security
Build a Port ScannerPython for Security
Container Security BasicsDocker and Containers
SQL InjectionWeb Application Attacks
Cross-Site ScriptingWeb Application Attacks
Command InjectionWeb Application Attacks
Server-Side Request ForgeryWeb Application Attacks
Insecure DeserializationWeb Application Attacks
Attacking AuthenticationWeb Application Attacks
Access Control and IDORWeb Application Attacks
Setting Up Burp and the ProxyBurp Suite
Crawling and ScanningBurp Suite
A Real Testing WorkflowBurp Suite
Post-ExploitationThe Metasploit Framework
A Repeatable Privesc MethodLinux Privilege Escalation
Dangerous Privileges and InstallersWindows Privilege Escalation
Hunting for CredentialsWindows Privilege Escalation
Evil Twin and Rogue APsWireless Security
OSINT FundamentalsOpen Source Intelligence
Mapping Infrastructure and DomainsOpen Source Intelligence
Google DorkingOpen Source Intelligence
Forensics Fundamentals and Chain of CustodyDigital Forensics
Disk and File System ForensicsDigital Forensics
Building a TimelineDigital Forensics
The Incident Response LifecycleIncident Response
Detection and TriageIncident Response
Containment, Eradication, RecoveryIncident Response
Log Analysis for RespondersIncident Response
Writing the Incident ReportIncident Response
What a SOC Actually DoesSOC Analyst Fundamentals
Alerts and TriageSOC Analyst Fundamentals
Working a ShiftSOC Analyst Fundamentals
Escalation and HandoffSOC Analyst Fundamentals
What a SIEM DoesSIEM and Log Analysis
Log Sources That MatterSIEM and Log Analysis
Writing Detection QueriesSIEM and Log Analysis
Correlation and AlertingSIEM and Log Analysis
The Hunting MindsetThreat Hunting
Hypothesis-Driven HuntingThreat Hunting
Hunting in LogsThreat Hunting
Documenting a HuntThreat Hunting
Dynamic Analysis BasicsMalware Analysis
IDS and IPSNetwork Defense
Detecting Lateral MovementNetwork Defense
Identity in the CloudCloud Security Fundamentals
Logging and MonitoringCloud Security Fundamentals
AWS IAM in DepthAWS Security
S3 SecurityAWS Security
Detection in AWSAWS Security
Kubernetes ArchitectureKubernetes Security
Attacking a ClusterKubernetes Security
Hardening a ClusterKubernetes Security
How Modern APIs WorkAPI Security
API Authentication FlawsAPI Security
Stack Buffer OverflowsIntroduction to Binary Exploitation
Audits and ComplianceGovernance, Risk, and Compliance
What Threat Intelligence Actually IsCyber Threat Intelligence
The Intelligence LifecycleCyber Threat Intelligence
IOCs and TTPsCyber Threat Intelligence
What Detection Engineering IsDetection Engineering
Writing Good DetectionsDetection Engineering
Sigma and YARADetection Engineering
Testing and Tuning DetectionsDetection Engineering
The Detection LifecycleDetection Engineering
Managing SecretsSecure Coding
The Mobile Threat ModelMobile Application Security
Common Mobile VulnerabilitiesMobile Application Security
Common IoT WeaknessesIoT and OT Security
Defending Connected DevicesIoT and OT Security
Why Crypto Implementations FailCryptographic Attacks
Recognizing Bad CryptoCryptographic Attacks
Why You Need a LabBuilding a Home Lab
Snapshots and Safe HabitsBuilding a Home Lab
STRIDEThreat Modeling
Threat Modeling a Real AppThreat Modeling
Structuring a ReportWriting Security Reports
Certs, Skills, and DegreesBreaking Into Security
Building a Portfolio That Gets NoticedBreaking Into Security
Prototype PollutionAdvanced Web Attacks
Building a Vuln Management ProgramVulnerability Management
Scanning and Authenticated ScansVulnerability Management
Authentication vs AuthorizationIdentity and Access Management
SSO and FederationIdentity and Access Management
Privileged Access ManagementIdentity and Access Management
MicrosegmentationZero Trust Architecture
Why Email Is a TargetEmail Security
Investigating a PhishEmail Security
DNS AttacksDNS and Network Services Security
Securing DNSDNS and Network Services Security
DHCP and NTP RisksDNS and Network Services Security
Monitoring Network ServicesDNS and Network Services Security
The Supply Chain Attack SurfaceSoftware Supply Chain Security
Signing and ProvenanceSoftware Supply Chain Security
Classifying DataData Protection and Privacy
Encryption at Rest and in TransitData Protection and Privacy
Key ManagementData Protection and Privacy
Exponents and LogarithmsMathematics Foundations
Integrals and AccumulationMathematics Foundations
Wave-Particle DualityQuantum Foundations