Log Sources That Matter
A firehose of logs and only a few of them ever catch an attacker.
What you will learn
- -Name the Windows and Sysmon event IDs that carry the most detection value
- -Explain why authentication, process creation, and DNS logs beat volume metrics
- -Spot the gaps a default logging config leaves wide open
Ship every you can and you will drown before you detect anything. access logs alone can hit millions of lines a day, and almost none of them matter for catching an intrusion. The skill is not collecting everything. It is knowing the handful of sources where attacker behavior actually shows up, and making sure those are turned on and forwarded before the , not after.
Authentication logs are the crown jewels
Nearly every attack touches auth at some point. On Windows , the Security carries the events you cannot live without:
$Event ID 4624$Event ID 4625$Event ID 4768 / 4769$Event ID 4720 / 4728Logon Type 3 with local admin creds hitting a dozen in a minute is lateral movement. A 4720 followed by a 4728 into Admins at 3 a.m. is . You cannot see either without these forwarded and normalized.
Process creation is where malware announces itself
runs processes, and process creation logging catches the command line it ran with. Windows Event ID 4688 gives you this, but only if you have enabled command-line auditing in Group . Out of the box, 4688 shows powershell.exe and nothing about what it ran, which is useless.
Sysmon is the upgrade. It is a free Microsoft Sysinternals driver that logs richer than the default Windows channels, and it is the single highest-value thing you can deploy on .
$Sysmon Event ID 1$Sysmon Event ID 3$Sysmon Event ID 11$Sysmon Event ID 22Event ID 1 showing winword.exe as the parent of powershell.exe -enc <base64> is a phishing macro detonating. That parent-child relationship is invisible in plain 4688 and obvious in Sysmon.
DNS and network logs catch the callback
traffic has to resolve a domain and phone home. query logs, whether from Sysmon Event 22, a Windows DNS debug log, or Zeek's dns.log, let you hunt for beaconing: the same host querying the same weird domain every sixty seconds like clockwork. Zeek's conn.log gives you the connection metadata (duration, bytes sent, bytes received) that reveals a slow exfil channel humans never notice by eye.
If your environment lives in cloud, the endpoint list is not enough. AWS CloudTrail, Azure Activity Logs, and Microsoft 365 Unified Log are the -plane equivalents of the Security Event Log. An attacker with stolen keys never touches an endpoint, and CloudTrail is the only place their actions show up.
Enabling Sysmon, command-line auditing, or DNS logging on hosts you do not own or administer is not your call to make. Deploy detection logging only across systems in your authorized , and coordinate with the owners, because verbose logging has real performance and privacy implications.
Your SOC has Windows Security logs but every 4688 shows only the executable name, no arguments. An analyst says 'we already log process creation, we're covered.' Why are they wrong, and what is the fix?
Logging that a process ran tells you almost nothing without what it ran. The whole detection value is in the command line and the parent-child chain, which default 4688 omits and Sysmon Event ID 1 captures.