Question 1

What should you look for when analyzing security logs?

Accepted Answer

Key indicators include unusual login times or locations, repeated failed authentication attempts, privilege escalation events, unexpected process executions, large data transfers, connections to known malicious IPs, and changes to critical system files. Correlating events across multiple log sources helps reveal the full picture of an attack.

Question 2

What tools are commonly used for log analysis in cybersecurity?

Accepted Answer

Security teams rely on SIEM platforms like Splunk, Elastic Security, and Microsoft Sentinel to aggregate and analyze logs. These tools support real-time alerting, pattern detection, and correlation across sources such as firewalls, endpoints, DNS, and authentication systems — enabling faster threat detection and incident response.

Log Analyzer

How to play

Frequently Asked Questions