📊 What is Log Analysis?
Log Analysis is the process of collecting, reviewing, and analyzing log files generated by systems, servers, applications, firewalls, and security devices. SOC analysts use logs to detect cyberattacks, investigate suspicious activities, identify system errors, and monitor security events in real time.
Every action inside a system leaves a digital footprint called a log. By analyzing these logs, security teams can identify brute-force attacks, malware infections, unauthorized access attempts, phishing attacks, and more.
🛡️ Why is Log Analysis Important in SOC?
- 🔍 Detect suspicious activities and cyberattacks
- 🚨 Identify brute-force login attempts
- 📧 Monitor phishing and email threats
- 🧠 Investigate malware infections
- 📊 Monitor network and system behavior
- 📁 Collect evidence during incident response
⚙️ Common Tools Used for Log Analysis
- 🛠️ Splunk – Enterprise SIEM and log analysis platform
- 📈 ELK Stack – Elasticsearch, Logstash, and Kibana
- 🛡️ Wazuh – Open-source security monitoring tool
- 📂 Graylog – Centralized log management
- 🐧 Linux Commands:
greptailcatlessjournalctl
🔐 SSH Log Analysis
SSH logs help SOC analysts detect unauthorized login attempts, brute-force attacks, and suspicious remote access activities.
📂 Common SSH Log Locations
/var/log/auth.log(Ubuntu/Debian)/var/log/secure(CentOS/RHEL)
🔎 Find Failed Login Attempts
grep "Failed password" /var/log/auth.log
🧠 Example Suspicious Log
Failed password for root from 192.168.1.5 port 45678 ssh2
This indicates someone attempted to log in as the root user using SSH but failed. Multiple failed attempts may indicate a brute-force attack.
📌 Find Successful SSH Logins
grep "Accepted password" /var/log/auth.log
📧 SMTP Log Analysis
SMTP logs are analyzed to detect spam activity, phishing attempts, email delivery issues, and malicious attachments.
📂 SMTP Log Locations
/var/log/mail.log/var/log/maillog
🔎 Check Failed Email Deliveries
grep "status=bounced" /var/log/mail.log
📌 Detect Suspicious Email Activity
grep "authentication failed" /var/log/mail.log
🧠 Example SMTP Log
authentication failed for unknown user from 10.10.10.5
This may indicate someone attempting unauthorized access to the mail server.
🌐 Web Server Log Analysis
Web server logs help identify attacks targeting websites and applications.
📂 Common Web Logs
/var/log/apache2/access.log/var/log/nginx/access.log
🔎 Find Suspicious Requests
grep "wp-login.php" access.log
Repeated requests to login pages may indicate brute-force attempts.
🚨 Common Indicators SOC Analysts Look For
- ❌ Multiple failed login attempts
- 🌍 Login attempts from unusual countries
- ⚠️ Privilege escalation events
- 📦 Malware execution alerts
- 📤 Large outbound data transfers
- 📧 Suspicious email attachments
- 🔑 Unauthorized account creation
🧪 Real-World Example: SSH Brute Force Attack
A SOC analyst notices thousands of failed SSH login attempts from the same IP address.
grep "Failed password" /var/log/auth.log | wc -l
After identifying the attacker's IP address, the analyst blocks the IP using a firewall and investigates whether any accounts were compromised.
🧠 Final Thoughts
Log analysis is one of the most important skills for a SOC analyst. Every cyberattack leaves traces inside logs, and understanding how to analyze them helps security teams detect, investigate, and respond to threats effectively.
Whether it’s SSH logs, SMTP logs, firewall logs, or web server logs, mastering log analysis will greatly improve your cybersecurity and incident response skills.
📂 FTP Log Analysis
FTP logs help SOC analysts identify unauthorized file transfers, brute-force attacks, and suspicious uploads or downloads.
📍 Common FTP Log Locations
/var/log/vsftpd.log/var/log/proftpd/proftpd.log/var/log/xferlog
🔎 Find Failed FTP Login Attempts
grep "FAIL LOGIN" /var/log/vsftpd.log
🧠 Example FTP Log
FAIL LOGIN: Client "192.168.1.10"
Multiple failed FTP login attempts may indicate a brute-force attack.
📤 Detect File Upload Activity
grep "UPLOAD" /var/log/xferlog
🌐 Web Login Attempt Analysis
Web application logs help analysts detect brute-force attacks, credential stuffing, SQL injection attempts, and suspicious login behavior.
📂 Common Web Server Logs
/var/log/apache2/access.log/var/log/nginx/access.log
🔎 Detect Login Attempts
grep "POST /login" access.log
🧠 Example Login Attempt Log
192.168.1.20 - - [25/May/2026:10:22:10] "POST /login HTTP/1.1" 401
Status code 401 indicates failed authentication.
🚨 Detect SQL Injection Attempts
grep "UNION SELECT" access.log
🔍 Detect Access to Admin Panels
grep "/admin" access.log
🔥 Firewall Log Analysis
Firewall logs help identify blocked attacks, port scans, malicious IP addresses, and suspicious network traffic.
📂 Common Firewall Logs
/var/log/ufw.log/var/log/firewalld
🔎 Find Blocked Connections
grep "BLOCK" /var/log/ufw.log
🧠 Example Firewall Log
UFW BLOCK IN=eth0 SRC=10.10.10.5 DST=192.168.1.8 PROTO=TCP DPT=22
This log shows the firewall blocked an incoming SSH connection attempt.
🦠 Malware & Process Log Analysis
SOC analysts monitor system logs and processes to detect malware execution and suspicious activities.
🔎 Find Suspicious Processes
ps aux
📌 Monitor System Logs
journalctl -xe
🧠 Example Suspicious Activity
python3 malware.py running as root
Unexpected scripts running with root privileges may indicate malware infection.
📡 Network Log Analysis
Network logs help identify unusual traffic patterns, scanning activity, and communication with malicious servers.
🔎 Check Active Connections
netstat -tulnp
📌 Monitor Live Network Traffic
tcpdump -i eth0
🧠 Detect Port Scanning
grep "SYN" firewall.log
Large numbers of SYN packets may indicate a port scanning attack.
📊 Advanced Log Analysis Techniques
- 🧠 Correlation Analysis: Compare logs from multiple systems to identify attack patterns.
- ⏰ Timeline Analysis: Track events in chronological order during investigations.
- 🌍 GeoIP Analysis: Identify suspicious login locations from different countries.
- 📈 Behavior Analysis: Detect unusual user or system behavior.
- 🚨 Alert Tuning: Reduce false positives in SIEM alerts.
- 🔍 Threat Hunting: Search logs proactively for hidden threats.
- 📦 IOC Matching: Compare logs with Indicators of Compromise (IOCs).
🛠️ Useful Linux Commands for Log Analysis
tail -f /var/log/auth.log
Monitor logs in real time.
grep "Failed" /var/log/auth.log
Search for failed login attempts.
awk '{print $1}' access.log
Extract IP addresses from logs.
sort access.log | uniq
Remove duplicate log entries.
