Log Analysis and SIEM

Logs are useless unaccessed and priceless when something breaks. SIEM (Security Information and Event Management) centralizes logs and turns them into alerts — the detective control behind intrusion detection.

#Start simple (single host)

journalctl -u ssh -f                      # live SSH events
journalctl -p err -S "1 hour ago"         # recent errors
grep -i "failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn

#Centralize (fleet)

#What to actually alert on

• Repeated auth failures → brute force (SSH Hardening, pairs with fail2ban).
• New listening port on a known host.
• A user running unusual commands / new sudo grants.
• IOCs from malware triage seen in traffic.

Rule: logs you never read are just disk usage. Centralize, then write a handful of high-signal alerts you'll actually act on.

Related: Intrusion Detection with a Network Scanner · SSH Hardening · Linux Server Hardening Baseline