[
  {
    "id": "log-001",
    "log_type": "Windows Security Event Log Analysis",
    "key_events": {
      "authentication": {
        "4624": "Successful logon - Monitor for unusual logon types (Type 3=Network, Type 10=RemoteInteractive)",
        "4625": "Failed logon - Brute force detection, count by source IP",
        "4634": "Logoff - Session duration analysis",
        "4648": "Explicit credential logon - Pass-the-hash detection",
        "4672": "Special privileges assigned - Admin logon detection",
        "4771": "Kerberos pre-auth failed - Kerberoasting detection",
        "4776": "NTLM authentication - NTLM relay detection"
      },
      "account_management": {
        "4720": "User account created - Unauthorized account detection",
        "4722": "User account enabled - Dormant account activation",
        "4724": "Password reset attempt - Account takeover detection",
        "4728": "Member added to security group - Privilege escalation",
        "4732": "Member added to local group - Local admin addition",
        "4756": "Member added to universal group - Domain admin escalation"
      },
      "policy_changes": {
        "4719": "Audit policy changed - Defense evasion detection",
        "4739": "Domain policy changed - Security policy modification",
        "4946": "Firewall rule changed - Network security modification"
      },
      "process_execution": {
        "4688": "Process created - Suspicious process detection",
        "4689": "Process exited - Process lifetime analysis"
      }
    },
    "analysis_queries": {
      "brute_force_detection": "index=windows EventCode=4625 | stats count by IpAddress, TargetUserName | where count > 10 | sort -count",
      "admin_logon_tracking": "index=windows EventCode=4672 | stats count by SubjectUserName, ComputerName | sort -count",
      "new_account_detection": "index=windows EventCode=4720 | table _time, ComputerName, SubjectUserName, TargetUserName",
      "privilege_escalation": "index=windows (EventCode=4728 OR EventCode=4732 OR EventCode=4756) | table _time, ComputerName, MemberName, GroupName",
      "policy_change_detection": "index=windows (EventCode=4719 OR EventCode=4739) | table _time, ComputerName, SubjectUserName"
    },
    "category": "log-analysis"
  },
  {
    "id": "log-002",
    "log_type": "Linux Authentication Log Analysis",
    "key_events": {
      "authentication": {
        "Accepted publickey": "Successful SSH key authentication - Monitor source IPs",
        "Accepted password": "Successful password authentication - Should be minimal",
        "Failed password": "Failed password attempt - Brute force detection",
        "Invalid user": "Invalid username attempt - Username enumeration",
        "session opened": "User session started - Login tracking",
        "session closed": "User session ended - Session duration"
      },
      "sudo_activity": {
        "COMMAND": "Sudo command execution - Privileged command tracking",
        "authentication failure": "Sudo auth failure - Unauthorized escalation",
        "USER_START": "Sudo session started - Privilege use",
        "USER_END": "Sudo session ended - Privilege use duration"
      }
    },
    "analysis_commands": {
      "failed_logins": "grep 'Failed password' /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn | head -20",
      "successful_logins": "grep 'Accepted' /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn",
      "sudo_commands": "grep 'COMMAND' /var/log/auth.log | awk -F'COMMAND=' '{print $2}' | sort | uniq -c | sort -rn",
      "invalid_users": "grep 'Invalid user' /var/log/auth.log | awk '{print $8}' | sort | uniq -c | sort -rn",
      "root_logins": "grep 'Accepted.*root' /var/log/auth.log",
      "login_timeline": "grep -E '(Accepted|Failed)' /var/log/auth.log | awk '{print $1,$2,$3}' | uniq -c"
    },
    "category": "log-analysis"
  },
  {
    "id": "log-003",
    "log_type": "Web Server Log Analysis",
    "key_events": {
      "access_patterns": {
        "200": "Successful request - Normal operation",
        "301/302": "Redirect - May indicate path enumeration",
        "400": "Bad request - Malformed input detection",
        "401": "Unauthorized - Authentication failure",
        "403": "Forbidden - Access attempt to restricted resource",
        "404": "Not found - Directory/file enumeration",
        "500": "Server error - Potential vulnerability exploitation"
      },
      "attack_indicators": {
        "SQLi": "Look for: union, select, insert, update, delete, drop, --, '",
        "XSS": "Look for: <script, onerror, onload, javascript:",
        "Command Injection": "Look for: ;, |, &, `, $, whoami, cat, ls",
        "Path Traversal": "Look for: ../, ..\\, %2e%2e",
        "Scanner": "Look for: nikto, sqlmap, nmap, burp in User-Agent"
      }
    },
    "analysis_commands": {
      "top_ips": "awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -20",
      "error_404": "awk '$9 == 404 {print $7}' access.log | sort | uniq -c | sort -rn | head -20",
      "sql_injection": "grep -iE '(union|select|insert|update|delete|drop|--|)' access.log",
      "xss_attempts": "grep -iE '(<script|onerror|onload|javascript:)' access.log",
      "scanner_detection": "grep -iE '(nikto|sqlmap|nmap|burp)' access.log",
      "large_responses": "awk '$10 > 1000000 {print $1,$7,$10}' access.log | sort -k3 -rn"
    },
    "category": "log-analysis"
  },
  {
    "id": "log-004",
    "log_type": "Firewall Log Analysis",
    "key_events": {
      "connection_events": {
        "ALLOW": "Permitted connection - Baseline for normal traffic",
        "DENY": "Blocked connection - May indicate attack or misconfiguration",
        "DROP": "Silently dropped - Stealth blocking"
      },
      "attack_indicators": {
        "port_scan": "Multiple connection attempts to different ports from same IP",
        "brute_force": "Repeated connections to same port (22, 3389, 80, 443)",
        "ddos": "High volume connections from multiple IPs to same target",
        "data_exfiltration": "Large outbound data transfers to unusual destinations",
        "c2_communication": "Regular beaconing patterns to external IPs"
      }
    },
    "analysis_commands": {
      "blocked_ips": "grep 'DENY' firewall.log | awk '{print $3}' | sort | uniq -c | sort -rn | head -20",
      "top_blocked_ports": "grep 'DENY' firewall.log | awk '{print $5}' | sort | uniq -c | sort -rn | head -20",
      "port_scan_detection": "grep 'DENY' firewall.log | awk '{print $3}' | sort | uniq -c | awk '$1 > 50' | sort -rn",
      "large_transfers": "awk '$NF > 1000000 {print $0}' firewall.log",
      "beaconing_detection": "grep 'ALLOW' firewall.log | awk '{print $3,$5}' | sort | uniq -c | sort -rn | head -20"
    },
    "category": "log-analysis"
  }
]