Overview
Logs are made of fields — the individual data elements that carry meaning. This lesson covers log fields and reading them.
Learning objectives
- Explain what log fields are.
- Identify common important fields.
- Connect fields to analysis and correlation.
Core concept
Fields are the individual data elements within a log entry — the pieces that carry specific meaning. Common important fields include: timestamp (when), source/destination (IPs, hosts, users — who/where), action/event type (what happened), status/result (success/failure), and identifiers (user, process, session). Reading and understanding fields is essential to analysis: they're what an analyst examines to understand an event, what detection logic matches against, and what enables correlation (linking events across logs by shared field values, like a common user or IP). Fields turn a log line into structured, analyzable information.
How it works
An analyst reads a log entry by interpreting its fields: the timestamp places it in time, source/destination fields identify who/where, the event/action field says what happened, and the result field says the outcome. Detection logic and searches operate on fields (e.g. "failed logins for a user"). Crucially, shared field values enable correlation — linking events across different logs by a common user, IP, host, or session to reconstruct a chain of activity. Understanding which fields matter (and their meaning in each log format) is what lets an analyst extract insight from logs and connect related events. Consistent field meaning across sources (aided by normalization, later) makes cross-source correlation possible.
Practical example
Analyzing an authentication log entry, the analyst reads its fields: the timestamp (when), the user and source IP (who/where), the event type (login attempt), and the result (failure). Seeing many such entries with the same user and source IP but repeated failure results, they recognize a possible brute-force pattern. They then correlate by the source IP field across other logs to see what else that IP did. Reading the fields — and correlating on shared values — turned raw log lines into a meaningful picture of the activity.
Cybersecurity relevance
Fields are the basis of log analysis, detection, and correlation: analysts read fields to understand events, detection logic matches on fields, and shared field values (user, IP, host, session) enable correlation across logs to reconstruct activity chains — central to investigation. Understanding important fields (timestamp, source/destination, action, result, identifiers) and their meaning in each format is a core analyst skill. Consistent field meaning across sources (via normalization, next lessons) makes cross-source correlation reliable. Fields are what transform raw logs into structured, analyzable, correlatable information — foundational to log analysis and SIEM use throughout the path.
Common mistakes
- Not understanding key fields or their meaning in a given log format.
- Overlooking correlation via shared field values (user, IP, host, session).
- Misreading fields (e.g. confusing source/destination or misinterpreting result codes).
Key takeaways
- Fields are the individual data elements in a log entry (timestamp, source/destination, action/event, result, identifiers) that carry specific meaning.
- Reading fields is essential to analysis; detection logic matches on fields, and shared field values enable correlation across logs to reconstruct activity.
- Understanding important fields (and consistent meaning across sources via normalization) transforms raw logs into analyzable, correlatable information — foundational to log analysis and SIEM.
Check your understanding
- What are common important log fields, and what does each convey?
- How do shared field values enable correlation across different logs?