From the course: CompTIA Advanced Security Practitioner (CASP+) (CAS-004) Cert Prep

Unlock this course with a free trial

Join today to access over 24,200 courses taught by industry experts.

Log collection and analysis

Log collection and analysis

From the course: CompTIA Advanced Security Practitioner (CASP+) (CAS-004) Cert Prep

Start my 1-month free trial Buy for my team

Log collection and analysis

“

- In this lesson, we're going to discuss log collection and analysis when working in the cloud. As you probably already know, conducting log reviews is a critical part of cybersecurity and information assurance. As cybersecurity practitioners, we need to gather the logs from our different operating systems and then analyze those to detect patterns, baselines, and anomalies. Logs should be consistently monitored and not only reviewed after an incident or data breach either. Log review and analysis isn't just part of your incident response efforts, but it needs to also be a routine and regular part of your threat hunting and system management efforts. Logs contain details about what events are occurring in your platforms, your systems, your applications, and your users. But logs are not always enabled by default in our cloud-based software tools. For example, if you use Slack, Zoom, Microsoft Teams, Confluence, Google Docs, and many others, they disable access audit logs by default to…

Contents