Security Information and Event Management (SIEM) systems aggregate and correlate raw telemetry from heterogeneous operating systems and network devices. Match each raw security log entry snippet to the specific security attack vector or operational event type it indicates.
- 192.168.1.104 - - [27/Jul/2026:14:22:10 +0000] "GET /products.php?id=10+UNION+SELECT+1,username,password_hash+FROM+users-- HTTP/1.1" 200 4521SQL Injection (SQLi) exfiltration attempt
- Jul 27 14:23:15 auth-srv sshd[14209]: Failed password for invalid user root from 198.51.100.42 port 49152 ssh2 (repeated 120 times in 30s)SSH authentication brute-force attack
- 2026-07-27 14:24:02 DST_IP=10.0.4.15 SRC_IP=192.168.1.50 PROTO=DNS QUERY=a666b61726b6574696e67.exfil.attacker-domain.com TYPE=TXT BYTES_OUT=4096DNS tunneling and data exfiltration
- EventID: 4672, SubjectUserSid: S-1-5-21-397955417-626881126-188441444-1105, Privileges: SeDebugPrivilege, SeTcbPrivilege, SeImpersonatePrivilegeWindows sensitive privilege assignment
Cevap
Each log snippet corresponds to its distinct event pattern: web access logs containing SQL syntax match SQL Injection exfiltration; rapid daemon SSH failures match SSH authentication brute-force; oversized TXT DNS queries with subdomains match DNS tunneling; and Windows Event ID 4672 with administrative privileges matches Windows sensitive privilege assignment.
Security event telemetry is categorized by analyzing protocol identifiers, signature payloads, and event codes. Web server logs containing SQL operators represent SQL Injection. Syslog authentication logs recording high-frequency failures represent SSH brute-force attacks. DNS logs displaying encoded subdomains and large TXT outputs represent DNS tunneling exfiltration. Windows Security Event ID 4672 specifically identifies administrative user privilege assignments upon session establishment.
Adım Adım Çözüm
Anahtar Kavram
Log signature identification and SIEM telemetry classification across heterogeneous enterprise security controls