Buckets:
| [ | |
| { | |
| "id": "log-001", | |
| "log_type": "Windows Security Event Log Analysis", | |
| "key_events": { | |
| "authentication": { | |
| "4624": "Successful logon - Monitor for unusual logon types (Type 3=Network, Type 10=RemoteInteractive)", | |
| "4625": "Failed logon - Brute force detection, count by source IP", | |
| "4634": "Logoff - Session duration analysis", | |
| "4648": "Explicit credential logon - Pass-the-hash detection", | |
| "4672": "Special privileges assigned - Admin logon detection", | |
| "4771": "Kerberos pre-auth failed - Kerberoasting detection", | |
| "4776": "NTLM authentication - NTLM relay detection" | |
| }, | |
| "account_management": { | |
| "4720": "User account created - Unauthorized account detection", | |
| "4722": "User account enabled - Dormant account activation", | |
| "4724": "Password reset attempt - Account takeover detection", | |
| "4728": "Member added to security group - Privilege escalation", | |
| "4732": "Member added to local group - Local admin addition", | |
| "4756": "Member added to universal group - Domain admin escalation" | |
| }, | |
| "policy_changes": { | |
| "4719": "Audit policy changed - Defense evasion detection", | |
| "4739": "Domain policy changed - Security policy modification", | |
| "4946": "Firewall rule changed - Network security modification" | |
| }, | |
| "process_execution": { | |
| "4688": "Process created - Suspicious process detection", | |
| "4689": "Process exited - Process lifetime analysis" | |
| } | |
| }, | |
| "analysis_queries": { | |
| "brute_force_detection": "index=windows EventCode=4625 | stats count by IpAddress, TargetUserName | where count > 10 | sort -count", | |
| "admin_logon_tracking": "index=windows EventCode=4672 | stats count by SubjectUserName, ComputerName | sort -count", | |
| "new_account_detection": "index=windows EventCode=4720 | table _time, ComputerName, SubjectUserName, TargetUserName", | |
| "privilege_escalation": "index=windows (EventCode=4728 OR EventCode=4732 OR EventCode=4756) | table _time, ComputerName, MemberName, GroupName", | |
| "policy_change_detection": "index=windows (EventCode=4719 OR EventCode=4739) | table _time, ComputerName, SubjectUserName" | |
| }, | |
| "category": "log-analysis" | |
| }, | |
| { | |
| "id": "log-002", | |
| "log_type": "Linux Authentication Log Analysis", | |
| "key_events": { | |
| "authentication": { | |
| "Accepted publickey": "Successful SSH key authentication - Monitor source IPs", | |
| "Accepted password": "Successful password authentication - Should be minimal", | |
| "Failed password": "Failed password attempt - Brute force detection", | |
| "Invalid user": "Invalid username attempt - Username enumeration", | |
| "session opened": "User session started - Login tracking", | |
| "session closed": "User session ended - Session duration" | |
| }, | |
| "sudo_activity": { | |
| "COMMAND": "Sudo command execution - Privileged command tracking", | |
| "authentication failure": "Sudo auth failure - Unauthorized escalation", | |
| "USER_START": "Sudo session started - Privilege use", | |
| "USER_END": "Sudo session ended - Privilege use duration" | |
| } | |
| }, | |
| "analysis_commands": { | |
| "failed_logins": "grep 'Failed password' /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn | head -20", | |
| "successful_logins": "grep 'Accepted' /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn", | |
| "sudo_commands": "grep 'COMMAND' /var/log/auth.log | awk -F'COMMAND=' '{print $2}' | sort | uniq -c | sort -rn", | |
| "invalid_users": "grep 'Invalid user' /var/log/auth.log | awk '{print $8}' | sort | uniq -c | sort -rn", | |
| "root_logins": "grep 'Accepted.*root' /var/log/auth.log", | |
| "login_timeline": "grep -E '(Accepted|Failed)' /var/log/auth.log | awk '{print $1,$2,$3}' | uniq -c" | |
| }, | |
| "category": "log-analysis" | |
| }, | |
| { | |
| "id": "log-003", | |
| "log_type": "Web Server Log Analysis", | |
| "key_events": { | |
| "access_patterns": { | |
| "200": "Successful request - Normal operation", | |
| "301/302": "Redirect - May indicate path enumeration", | |
| "400": "Bad request - Malformed input detection", | |
| "401": "Unauthorized - Authentication failure", | |
| "403": "Forbidden - Access attempt to restricted resource", | |
| "404": "Not found - Directory/file enumeration", | |
| "500": "Server error - Potential vulnerability exploitation" | |
| }, | |
| "attack_indicators": { | |
| "SQLi": "Look for: union, select, insert, update, delete, drop, --, '", | |
| "XSS": "Look for: <script, onerror, onload, javascript:", | |
| "Command Injection": "Look for: ;, |, &, `, $, whoami, cat, ls", | |
| "Path Traversal": "Look for: ../, ..\\, %2e%2e", | |
| "Scanner": "Look for: nikto, sqlmap, nmap, burp in User-Agent" | |
| } | |
| }, | |
| "analysis_commands": { | |
| "top_ips": "awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -20", | |
| "error_404": "awk '$9 == 404 {print $7}' access.log | sort | uniq -c | sort -rn | head -20", | |
| "sql_injection": "grep -iE '(union|select|insert|update|delete|drop|--|)' access.log", | |
| "xss_attempts": "grep -iE '(<script|onerror|onload|javascript:)' access.log", | |
| "scanner_detection": "grep -iE '(nikto|sqlmap|nmap|burp)' access.log", | |
| "large_responses": "awk '$10 > 1000000 {print $1,$7,$10}' access.log | sort -k3 -rn" | |
| }, | |
| "category": "log-analysis" | |
| }, | |
| { | |
| "id": "log-004", | |
| "log_type": "Firewall Log Analysis", | |
| "key_events": { | |
| "connection_events": { | |
| "ALLOW": "Permitted connection - Baseline for normal traffic", | |
| "DENY": "Blocked connection - May indicate attack or misconfiguration", | |
| "DROP": "Silently dropped - Stealth blocking" | |
| }, | |
| "attack_indicators": { | |
| "port_scan": "Multiple connection attempts to different ports from same IP", | |
| "brute_force": "Repeated connections to same port (22, 3389, 80, 443)", | |
| "ddos": "High volume connections from multiple IPs to same target", | |
| "data_exfiltration": "Large outbound data transfers to unusual destinations", | |
| "c2_communication": "Regular beaconing patterns to external IPs" | |
| } | |
| }, | |
| "analysis_commands": { | |
| "blocked_ips": "grep 'DENY' firewall.log | awk '{print $3}' | sort | uniq -c | sort -rn | head -20", | |
| "top_blocked_ports": "grep 'DENY' firewall.log | awk '{print $5}' | sort | uniq -c | sort -rn | head -20", | |
| "port_scan_detection": "grep 'DENY' firewall.log | awk '{print $3}' | sort | uniq -c | awk '$1 > 50' | sort -rn", | |
| "large_transfers": "awk '$NF > 1000000 {print $0}' firewall.log", | |
| "beaconing_detection": "grep 'ALLOW' firewall.log | awk '{print $3,$5}' | sort | uniq -c | sort -rn | head -20" | |
| }, | |
| "category": "log-analysis" | |
| } | |
| ] | |
Xet Storage Details
- Size:
- 6.82 kB
- Xet hash:
- eeaa7456ec726697224c803a6d7608c863bfa052e9097f9f53887d89ae13795f
·
Xet efficiently stores files, intelligently splitting them into unique chunks and accelerating uploads and downloads. More info.