Defensive › Module 7 › Lesson 1
Why Central
One searchable timeline beats twenty laptops — central logging concept on YOUR lab fleet.
Visual · t16_why_central
Central logging = aggregate for search and retention. Original Cyberlium.
Opening
An attacker loves laptops that never phone home their logs — central collection fixes that for defenders.
Scattered logs on individual hosts rot, get wiped, and miss correlation. Centralized logging collects syslog, Windows events, or agent-forwarded records into a SIEM or log stack you operate for YOUR lab ($LAB fleet). Learn why aggregation, retention, and access control matter — design on paper or small lab stack you own, never ship stranger logs to your server or ingest production without authorization.
1. Problems with local-only logs
Disk full, attacker timestomp, laptop lost — local logs vanish.
Cross-host correlation (lateral movement) needs one timeline.
Command guide
Try these commands — Problems with local-only logs
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Central logging — https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html NIST log guide — https://csrc.nist.gov/publications/detail/sp/800-92/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
Built-in (iproute2)
macOS: Use: netstat
Windows: Built-in (PowerShell: Invoke-WebRequest) Use: netstat
═══ LINUX / macOS ═══
Command — copy this
curl -sS http://127.0.0.1:9200/ 2>/dev/null | head -c 200 || curl -sS http://127.0.0.1:5044/ -o /dev/null -w "log shipper port %{http_code}
" || echo 'Point curl at YOUR local SIEM/log stack when ready'
ss -tulpn 2>/dev/null | grep -E ':9200|:5044|:5514' || ss -tuln | head -10Primary tools to practice this lesson: curl, ss. Reference sites: Central logging (https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html); NIST log guide (https://csrc.nist.gov/publications/detail/sp/800-92/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Central benefits
Search, alert, retain, and restrict access in one place.
Backup and integrity controls apply to the log store itself.
3. Scope
Lab designs central collector for $LAB VMs only. No exfil of third-party logs.
Privacy: minimize PII in shared lab SIEM; redact in notes.
4. What you ship: why central paragraph
Local-only risks + central benefits + $LAB fleet scope.
5. What you record before the next lesson
Why central logging paragraph.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Point rsyslog from a café PC to your home collector.
Right
Explain why central. Next: ship and collect.
Mission: why central notes
1) List two local-only log risks. 2) List two central benefits. 3) Write $LAB-only ingestion rule.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “SIEM vs plain syslog server?”
Knowledge Check
APPLY: Central logging helps:
Multiple choice
Knowledge Check
APPLY: True or False: Ingest stranger logs without consent is lab.
True or False
Knowledge Check
APPLY: Local-only log risk:
Multiple choice