A security analyst is triaging log files collected by a SIEM system across web applications, authentication servers, and system logs. Match each log snippet on the left to the corresponding security event or attack vector on the right.
- 192.168.1.50 - - [27/Jul/2026:10:14:32] "GET /products.php?id=1%20UNION%20SELECT%20username,password%20FROM%20users-- HTTP/1.1" 200 452SQL Injection (SQLi) Web Attack
- Jul 27 10:15:01 server1 sshd[4102]: Failed password for invalid user admin from 203.0.113.45 port 51234 ssh2 (repeated 450 times in 60s)SSH Automated Password Guessing / Brute-Force Attack
- Event ID 4624: An account was successfully logged on. Logon Type: 10 (RemoteInteractive). Account Name: AdminUser.Remote Desktop Protocol (RDP) Interactive Session
- 10.0.0.15 - - [27/Jul/2026:10:20:00] "GET /../../../../etc/passwd HTTP/1.1" 403 220Directory / Path Traversal Attempt
Answer
The HTTP snippet containing 'UNION SELECT' matches SQL Injection; the repeated SSH failed authentication log matches SSH Brute-Force; Windows Event ID 4624 with Logon Type 10 matches RDP Interactive Session; and the HTTP request with '../../' sequences matches Directory/Path Traversal.
Each log entry displays distinct forensic indicators: 'UNION SELECT' points directly to SQL injection; repeated SSH authentication failures indicate brute-force attempts; Windows Event 4624 with Logon Type 10 marks remote interactive RDP logons; and dot-dot-slash patterns indicate path traversal attempts.
Step-by-Step Solution
Key Concept
Log Telemetry Analysis and Threat Identification