List five types of logs that are most commonly used to detect intrusion activity.

Question

List five types of logs that are most commonly used to detect intrusion activity.

Answer 1

Hi Sarah, Well, it depends on the environment. There's an influx of companies that provide systems that can perform unique detection. However, there are basic log(s) or logging that can be commonly used. For example:

IDS/IPS logs

Email logs

AWS/Azure logs

Windows/Linux Event logs

Depending on the configuration of your environment, there may be some additional Network Data logs, such as (Traffic Logs)