Overview
Log sources are the systems that produce the logs a SOC analyzes. This lesson covers the major log sources and what each provides.
Learning objectives
- Identify major log sources in an environment.
- Explain what each source reveals.
- Connect log sources to detection coverage.
Core concept
Log sources are the systems and devices that generate logs the SOC collects and analyzes. Major sources include: authentication systems (logins, privilege use), endpoints (process/system activity), network devices (firewalls, routers, traffic/flow), servers and applications (service activity, errors), security tools (IDS/EDR/antivirus alerts), and cloud services. Each source reveals a different slice of activity, so which sources are logged determines detection coverage. Comprehensive log-source coverage (guided by monitoring goals) is essential — you can only detect what your log sources capture.
How it works
The SOC collects logs from relevant sources across the environment, each providing distinct visibility: authentication logs reveal login/access activity (key for detecting account compromise); endpoint logs reveal process/system behavior (malware, persistence); network logs reveal traffic patterns (intrusion, exfiltration); application/server logs reveal service activity and errors; security-tool logs provide detections; cloud logs reveal cloud activity. Combining sources gives broad coverage and enables correlation across them (a threat may show partial signals in several sources). Gaps in log sources create blind spots. Log-source selection is goal-driven (collect what's needed to detect the targeted threats). Understanding what each source reveals guides both coverage and investigation.
Practical example
Investigating a possible account compromise, the SOC draws on multiple log sources: authentication logs show the suspicious login, endpoint logs show what the account did afterward, and network logs show any unusual outbound activity. Each source contributed a piece; together they reveal the full picture. Had, say, endpoint logs not been collected (a gap), the post-login activity would have been a blind spot. The breadth of log sources enabled both detection and a complete investigation — showing why comprehensive log-source coverage matters.
Cybersecurity relevance
Log sources determine detection coverage: each source reveals a different slice of activity, so comprehensive, goal-driven log-source coverage is essential — the SOC can only detect what its sources capture, and gaps create blind spots. Combining sources (authentication, endpoint, network, application, security-tool, cloud) enables correlation across them for higher-confidence detection (a threat's signals may span sources). Understanding what each source reveals guides coverage decisions and investigations (knowing where to look). It builds on telemetry (module 3) and feeds normalization, correlation (SIEM), and investigation. Log-source coverage is foundational to effective detection and the SOC's visibility.
Common mistakes
- Missing key log sources (blind spots), leaving activity undetected.
- Not correlating across sources, missing threats whose signals span several.
- Collecting sources without understanding what each reveals, hampering investigation.
Key takeaways
- Log sources are the systems generating logs the SOC analyzes: authentication, endpoints, network devices, servers/applications, security tools, and cloud services.
- Each reveals a different slice of activity, so comprehensive, goal-driven coverage determines detection reach; gaps create blind spots.
- Combining sources enables cross-source correlation for higher-confidence detection; understanding what each reveals guides coverage and investigation — foundational to visibility.
Check your understanding
- Name major log sources and what each reveals.
- Why does log-source coverage determine detection reach, and why correlate across sources?