QuestionQ2

VerifiedLog Management

A large web-hosting service provider, Web4Everyone, is responsible for hosting multiple major websites, social-media platforms, and more. You work here as an L1 SOC analyst responsible for investigating web-server logs for potential malicious activity.

Recently, your team detected multiple failed login attempts and unusual traffic patterns targeting the company’s web application. To efficiently analyze the logs and identify key details such as the remote host, username, timestamp, requested resource, HTTP status code, and user-agent, you need a structured log format that enables quick and accurate parsing.

Which standardized log format will you select for this scenario?

Explanation

Extended Log Format supports a configurable field declaration, allowing logs to record the client address, authenticated user, date and time, requested URI, response status, and request-header values such as User-Agent. Common Log Format uses a fixed set of fields and does not include the User-Agent value.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!