Cybersecurity · Intermediate level

Intermediate level · Module 4 of 6 · 13 guided hours

Logging and Detecting Suspicious Activity

Collect and review logs to notice attacks early.

Learning objectives

  • Identify useful log sources
  • Review sign-in and security logs for suspicious patterns
  • Set up simple alerts

Topics

  • log sources
  • Windows Event Viewer
  • cloud sign-in logs
  • failed logins
  • baselines and anomalies
  • alerts

Lessons

  1. Lesson 1 Log Sources

    Know where evidence of activity is recorded.

    event logssign-in logsfirewall logsretention

  2. Lesson 2 Reading Sign-In and Security Logs

    Spot patterns that suggest an attack.

    failed sign-insbaselineunusual location or timeaccount lockout

  3. Lesson 3 Alerts and Response Routines

    Get notified about important events and act on them consistently.

    alertsalert fatiguetriagereview routine

Practical activity

Review provided sign-in logs and a lab computer's security events to find a password-guessing attempt and an unusual sign-in, then set up alerts.

Expected outcomes

  • Ability to spot suspicious patterns
  • Alerts for the most important events

Assessment

Log review findings and alert configuration checked.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.