Why this matters
Logs are the evidence of what happened on a system. Adverts for analyst roles in Ghana list log analysis and monitoring for malicious activity, and O*NET's description of information security analysts includes monitoring and network tools. Without logs, an investigation is guesswork.
What a log is
A log is a record a system writes when something happens: a login, a failed password, a file change, a connection, an error. Each entry usually has:
- When: a timestamp.
- Where: which system or device.
- Who: a user name or IP address.
- What: the action and whether it succeeded.
Logs that matter most to defenders
- Authentication logs: logins and failures on Windows, Linux, email and business apps.
- Firewall and network logs: which connections were allowed or blocked.
- Endpoint and antivirus logs: malware detections and suspicious programs.
- Application logs: actions inside systems such as a core banking or mobile money platform.
- Email logs: messages sent, received and blocked.