1 1 00:00:00,240 --> 00:00:01,620 Event logs. 2 2 00:00:01,620 --> 00:00:04,380 In this lesson we are going to talk about event logs, 3 3 00:00:04,380 --> 00:00:06,180 and event logs are logs that are created 4 4 00:00:06,180 --> 00:00:09,060 by your operating system on each and every client 5 5 00:00:09,060 --> 00:00:11,040 or server to record how the users 6 6 00:00:11,040 --> 00:00:14,070 and the software interact with that system. 7 7 00:00:14,070 --> 00:00:16,980 Now, the format of these event logs is going to vary based 8 8 00:00:16,980 --> 00:00:18,930 on the operating system you're dealing with. 9 9 00:00:18,930 --> 00:00:20,790 Each one uses its own format 10 10 00:00:20,790 --> 00:00:23,730 so whether you're using Windows or Mac or Linux 11 11 00:00:23,730 --> 00:00:25,290 it's going to be different. 12 12 00:00:25,290 --> 00:00:27,900 In this lesson, we are going to focus on Windows logs 13 13 00:00:27,900 --> 00:00:31,410 and the next lesson we'll talk more about Mac and Linux. 14 14 00:00:31,410 --> 00:00:34,260 Now Windows logs have five different categories 15 15 00:00:34,260 --> 00:00:37,260 of events that you can find inside your Windows event logs. 16 16 00:00:37,260 --> 00:00:41,010 These are application, security, system, setup 17 17 00:00:41,010 --> 00:00:42,630 and forwarded events. 18 18 00:00:42,630 --> 00:00:44,130 The first one is application 19 19 00:00:44,130 --> 00:00:46,680 and application focuses on events that are generated 20 20 00:00:46,680 --> 00:00:48,570 by applications and services. 21 21 00:00:48,570 --> 00:00:50,940 For instance, if you tried to start up a printer service 22 22 00:00:50,940 --> 00:00:53,280 and that wouldn't run, that would actually get logged 23 23 00:00:53,280 --> 00:00:56,970 as an application event inside of the Windows event log. 24 24 00:00:56,970 --> 00:00:58,800 The second one we have is security, 25 25 00:00:58,800 --> 00:01:01,112 and security is going to conduct things like audit events 26 26 00:01:01,112 --> 00:01:04,350 things like failing to log on or access being denied 27 27 00:01:04,350 --> 00:01:06,990 to a file, anything that has to do with security 28 28 00:01:06,990 --> 00:01:09,600 this is going to go into your security event logs. 29 29 00:01:09,600 --> 00:01:12,210 Then we have system, system is our third one 30 30 00:01:12,210 --> 00:01:13,710 and this is any events that's shared 31 31 00:01:13,710 --> 00:01:15,990 by the operating system and its services. 32 32 00:01:15,990 --> 00:01:19,050 So if Windows has an error or one of the Windows services 33 33 00:01:19,050 --> 00:01:22,350 has an error it's going to get logged underneath system. 34 34 00:01:22,350 --> 00:01:24,210 This would be things like your storage volume 35 35 00:01:24,210 --> 00:01:26,580 health check fails or something like that. 36 36 00:01:26,580 --> 00:01:28,770 And then we have our fourth one, which is setup. 37 37 00:01:28,770 --> 00:01:30,210 This is going to be events that are generated 38 38 00:01:30,210 --> 00:01:32,640 during the installation of Windows, so if you have any kind 39 39 00:01:32,640 --> 00:01:34,753 of errors or events that need to be logged during the setup 40 40 00:01:34,753 --> 00:01:37,500 that's going to happen under the setup category. 41 41 00:01:37,500 --> 00:01:40,230 And our fifth and final one is forwarded events, 42 42 00:01:40,230 --> 00:01:42,450 these are events that are sent to that local host 43 43 00:01:42,450 --> 00:01:44,520 that you're looking at from other computers 44 44 00:01:44,520 --> 00:01:45,353 and we'll talk a little bit more 45 45 00:01:45,353 --> 00:01:47,010 about that towards the end of this lesson. 46 46 00:01:47,010 --> 00:01:49,080 Now, in addition to these five categories 47 47 00:01:49,080 --> 00:01:50,700 we also have four categories 48 48 00:01:50,700 --> 00:01:52,646 of severity for each of these events. 49 49 00:01:52,646 --> 00:01:54,300 And this is all going to happen again 50 50 00:01:54,300 --> 00:01:56,310 inside your Windows event logs. 51 51 00:01:56,310 --> 00:01:58,110 These are information which is used 52 52 00:01:58,110 --> 00:02:01,020 for successful events, warnings, which is used 53 53 00:02:01,020 --> 00:02:02,880 for events that aren't necessarily a problem 54 54 00:02:02,880 --> 00:02:04,860 but they could end up being a problem in the future. 55 55 00:02:04,860 --> 00:02:07,770 For instance, you're getting low on disk space, errors, 56 56 00:02:07,770 --> 00:02:09,750 which are events that have significant problems 57 57 00:02:09,750 --> 00:02:13,320 and could result in reduced functionality and audit success 58 58 00:02:13,320 --> 00:02:15,870 and failure, which is an event that indicates a user 59 59 00:02:15,870 --> 00:02:17,220 or service either fulfilled 60 60 00:02:17,220 --> 00:02:20,220 or did not fulfill the system's audit policies. 61 61 00:02:20,220 --> 00:02:22,950 These are kind of unique inside of your security log 62 62 00:02:22,950 --> 00:02:25,350 and you're not going to see them in some of the other logs. 63 63 00:02:25,350 --> 00:02:27,990 Now, in addition to all that, each time you look at an entry 64 64 00:02:27,990 --> 00:02:30,900 inside your event log, you're going to get some details. 65 65 00:02:30,900 --> 00:02:33,210 You're going to get the name of the event, the details 66 66 00:02:33,210 --> 00:02:35,790 of any errors that occurred, the event ID, 67 67 00:02:35,790 --> 00:02:38,130 the source of the event, and a description of what 68 68 00:02:38,130 --> 00:02:40,140 the warning or error means. 69 69 00:02:40,140 --> 00:02:42,270 This should all be reviewed from you because we did cover 70 70 00:02:42,270 --> 00:02:44,640 this back in A+ and security plus as part of 71 71 00:02:44,640 --> 00:02:46,440 those exam objectives. 72 72 00:02:46,440 --> 00:02:48,480 Now, the final thing I want to talk about is forwarding 73 73 00:02:48,480 --> 00:02:51,510 and we talked about forwarded events as the fifth category. 74 74 00:02:51,510 --> 00:02:54,000 Now forwarded events is a relatively new concept 75 75 00:02:54,000 --> 00:02:56,730 that was added inside the modern Windows systems, 76 76 00:02:56,730 --> 00:02:58,320 Windows eight and beyond. 77 77 00:02:58,320 --> 00:03:00,000 Now this provides event subscriptions 78 78 00:03:00,000 --> 00:03:02,550 that forwards all the events to a single host 79 79 00:03:02,550 --> 00:03:04,110 and allows for a more holistic view 80 80 00:03:04,110 --> 00:03:07,560 of network events using an XML formatted message that ends 81 81 00:03:07,560 --> 00:03:10,890 in the .evtx extension for event. 82 82 00:03:10,890 --> 00:03:12,210 Now, the idea here is that we want to be able 83 83 00:03:12,210 --> 00:03:14,190 to take all the events from all of our systems 84 84 00:03:14,190 --> 00:03:15,810 and send them to a centralized server 85 85 00:03:15,810 --> 00:03:17,730 just like we talked about with SIEMs. 86 86 00:03:17,730 --> 00:03:20,280 Well, with SIEMs, you might have used an agent 87 87 00:03:20,280 --> 00:03:22,200 and installed something on the system. 88 88 00:03:22,200 --> 00:03:24,716 As of Windows eight and Windows 10, that has now been built 89 89 00:03:24,716 --> 00:03:27,360 into the operating system by Microsoft, 90 90 00:03:27,360 --> 00:03:28,710 so you don't need to have a separate agent, 91 91 00:03:28,710 --> 00:03:30,510 there's one built into the operating system 92 92 00:03:30,510 --> 00:03:32,933 and that's what this event forwarding is all about.