Log analysis for incident response is the systematic examination of system, application, network, and security logs to detect, investigate, and reconstruct cybersecurity incidents. Logs provide the most comprehensive record of activity across an IT environment, capturing authentication events, network connections, process executions, file operations, and security tool alerts. Effective log analysis during incident response requires both automated correlation through SIEM platforms and manual investigation techniques to piece together the full narrative of an attack.
Incident responders begin by identifying relevant log sources based on the incident type: Windows Event Logs for endpoint compromises, firewall and proxy logs for network intrusions, authentication logs for credential-based attacks, and application logs for web-based exploits. SIEM platforms aggregate and normalize logs from across the environment, enabling cross-source correlation. Analysts construct search queries and timelines to trace attacker activity from initial access through lateral movement to objective completion. Key log artifacts include Event IDs 4624/4625 for logon events, 4688 for process creation, Sysmon events for detailed endpoint telemetry, and DNS query logs for C2 detection. Sigma rules provide vendor-agnostic detection logic that translates across SIEM platforms.
Logs are often the only evidence available for incidents where memory has been lost and disk evidence is limited. Centralized logging with adequate retention enables investigation of incidents discovered weeks or months after initial compromise. Log analysis also identifies the full scope of an incident, revealing lateral movement paths and additional compromised systems that may not have triggered alerts. Without competent log analysis, incident responders operate with an incomplete picture, leading to inadequate containment and missed attacker persistence mechanisms.
CDA treats log architecture as a cross-domain concern spanning TID and SPH. Our C-BUILD campaigns establish centralized logging with appropriate retention policies, while C-HARDEN missions validate log coverage through adversary simulation. CDA's theater includes missions for SIEM deployment, Sigma rule development, and log analysis training. We emphasize that logging infrastructure must be in place before an incident occurs -- you cannot analyze logs you never collected.