Digital › Module 6 › Lesson 2
Log Sources
Log source literacy — Windows Event, syslog, web, firewall, EDR — map fields and UTC on $DFIR_LAB practice evidence.
Visual · t26_log_sources
Log sources = named anchors for timeline. $DFIR_LAB. Original Cyberlium.
Opening
Logs are witness statements — know which witness speaks which dialect before you correlate a case on unauthorized systems.
DFIR log literacy names primary sources: Windows Security/System/Application (4624 logon, 4688 process, 1102 log cleared), Linux syslog/auth, web server access/error, firewall deny/allow, DNS query logs, EDR process/network telemetry. Analyst maps each source to UTC normalization, retention limits, and chain-of-custody export method on $DFIR_LAB practice images — NOT pulling employer SIEM without ticket, NOT deleting logs to 'reduce noise,' NOT fabricating log lines for capstone drama. Pair with Module 1 CoC: export hash, tool version, time sync proof. Lab row: three log sources from practice case with one Event ID or field name each and timeline join key (UTC timestamp + hostname).
1. Named log families
Host OS: Windows Event IDs, Linux auth.log/journal. Network: firewall, DNS, proxy. App: web, mail, DB audit.
Each family has retention and clock skew risks — document sync method on $DFIR_LAB.
Command guide
Try these commands — Named log families
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
journalctl — https://www.freedesktop.org/software/systemd/man/latest/journalctl.html (Linux log literacy) CISA log review — https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response SANS DFIR — https://www.sans.org/cyber-security-skills/digital-forensics/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}journal on YOUR machine — last 20 lines literacy
Command — copy this
journalctl -n 20 --no-pager 2>/dev/null | head -20 || echo 'journalctl unavailable — use fake-log-lines.txt' grep -E 'sshd|sudo|kernel' "$LAB_DFIR/notes/fake-log-lines.txt" | head -5
Primary tools to practice this lesson: journalctl, grep. Reference sites: journalctl (https://www.freedesktop.org/software/systemd/man/latest/journalctl.html); CISA log review (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response); SANS DFIR (https://www.sans.org/cyber-security-skills/digital-forensics/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Export hygiene
Export read-only; hash archive; note parser version — same discipline as disk images Module 3.
Redact account names in share-safe notes; full names in chmod 600 mentor pack only.
3. Scope refuse
No unauthorized SIEM queries, no log clearing on systems you do not admin with legal authority.
Synthetic logs OK when brief labels them — never present forged logs as real evidence.
4. What you ship: log source cheat sheet
Six log families + UTC join key + three lab source rows + refuse unauthorized export line.
5. What you record before the next lesson
Log source cheat sheet path.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Query production SIEM without authorization and submit export as lab evidence.
Right
Log source cheat sheet from $DFIR_LAB practice case. Next: EXIF/Strings.
Mission: log source cheat sheet
1) Name six log families. 2) Define UTC join key. 3) Three lab source rows with one field each. 4) Write NEVER unauthorized SIEM line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “1102 log cleared — timeline impact?”
Knowledge Check
APPLY: Log literacy uses evidence from:
Multiple choice
Knowledge Check
APPLY: True or False: Clearing logs on unauthorized systems is lab.
True or False
Knowledge Check
APPLY: Timeline join key typically includes:
Multiple choice