Lab 1.3 — Know Your Logs

Lab Overview

---

Part 1: Explore the Event Landscape

When you click Start Lab, a Wazuh environment will spin up with 500+ pre-loaded events from 4 agents representing a small enterprise network: a Linux web server, a Windows domain server, a DNS server, and an edge firewall.

Step 1: Log In and Open Security Events

Click the lab link to open the Wazuh Dashboard.

Credentials:

• Username: admin
• Password: SecretPassword

Navigate to Modules → Security Events. You should see hundreds of events. Set the time range to Last 24 hours (or wider) to ensure you see all pre-loaded data.

Step 2: Survey the Agents

Click the Agents tab in the top navigation. You should see 4 agents reporting:

---

Part 2: Identify All 10 Log Sources

Your lab environment contains events from 10 distinct log sources. Your job is to find each one, understand what it tells you, and document it.

Click to enlarge

The 10 Log Sources

Use the search bar and filters in Security Events to find events from each source. For each one, find at least 2-3 example events and study them.

Step 3: Windows Authentication — Event IDs 4624 & 4625

Filter by agent WIN-SERVER-01 and look for events with eventID: 4624 (successful logon) and eventID: 4625 (failed logon).

What to look for in 4624 events:

Find examples of logon types 2, 3, 5, and 10. Notice how they tell very different stories:

• Type 5 (Service) = automated, normal
• Type 10 (RemoteDesktop) = human, investigate if unexpected
• Type 3 (Network) from an external IP = suspicious

What to look for in 4625 events:

Step 4: Windows Process Creation — Event ID 4688

Filter for eventID: 4688. These events log every new process on the Windows server.

Find examples of:

• Normal system processes (svchost.exe, services.exe)
• User applications (chrome.exe, WINWORD.EXE)
• Suspicious processes (check for executables in \Temp\, \ProgramData\, or \Users\Public\)

Step 5: Windows New Service — Event ID 7045

Filter for eventID: 7045. These fire when a new Windows service is installed.

Look for services running from unusual paths (\Temp\, \ProgramData\) or with generic names designed to blend in (WindowsUpdateHelper, SysHealthMonitor).

Step 6: SSH Authentication — /var/log/auth.log

Filter by agent linux-web-01 and look for SSH events (rule groups containing sshd).

Compare the srcip field: internal IPs (10.0.x.x) are expected, external IPs (185.x.x.x) are suspicious.

Step 7: Sudo and Privilege Escalation

Stay on linux-web-01 and filter for rule group sudo.

Study the full_log field — it contains exactly what command was run as root. Look for:

• Normal admin work: apt update, systemctl restart
• Suspicious activity: cat /etc/shadow, bash -c '...', commands in /tmp/

Step 8: DNS Queries

Filter by agent dns-server-01 (agent 003) or rule group dns.

Sort through the queries and separate them into categories:

• Normal: windowsupdate.microsoft.com, github.com, time.google.com
• Suspicious: Domains with unusual TLDs (.xyz, .cc, .io for non-tech companies), very long subdomains (DNS tunneling indicator), domains containing random strings

Step 9: Firewall Blocks

Filter by agent fw-edge-01 (agent 004) or rule group firewall_drop.

Look for patterns:

• Same source IP hitting multiple ports = port scan
• Hits on port 22, 3389, 445 = remote access attempts
• Hits on port 4444, 5900 = reverse shell / VNC (high priority)

Step 10: Agent Heartbeat and File Integrity Monitoring

Agent Heartbeat (rule 530): Filter for rule ID 530. These confirm which agents are alive and reporting. If heartbeats stop, the agent may be down — or an attacker may have disabled it.

File Integrity Monitoring (FIM): Filter for rule group syscheck. Three event types:

Pay special attention to: /etc/passwd, /etc/shadow, /etc/sudoers (Linux), hosts file, and anything in /tmp/ or web directories.

---

Part 3: Build Your Log Source Reference Sheet

Click to enlarge

Step 11: Complete the Reference Sheet

For each of the 10 log sources, fill in this table based on what you observed:

Step 12: Identify the Gaps

After completing your reference sheet, answer these questions:

1. Which log sources gave you the most security-relevant events? Rank your top 3 by detection value.
2. Which agent had the most suspicious activity? Why?
3. What log sources are missing? Think about what a real enterprise would have that this lab doesn't (hint: endpoint telemetry like Sysmon, email logs, proxy logs, cloud audit trails).
4. If you could only keep 3 log sources, which 3 would you choose and why?

---

Deliverables Checklist

Before marking this lab complete, verify you have:

• Log Source Reference Sheet — All 10 rows completed with descriptions, examples, and ATT&CK mappings
• Filter Proficiency — You can filter by agent, rule group, event ID, and severity in the Wazuh Dashboard
• Gap Analysis — You answered the 4 gap analysis questions
• ATT&CK Connection — Each log source is linked to at least one ATT&CK technique from Lab 1.2

What's Next

You've completed Module 1 — The SOC: Your War Room. You can now trace alerts (Lab 1.1), map detection coverage (Lab 1.2), and catalog your data sources (Lab 1.3). In Module 2 — SIEM Mastery, you'll go deeper into Wazuh: building custom dashboards, writing search queries, understanding correlation rules, and learning how Wazuh turns raw logs into the alerts you've been investigating.