Lessons · Cybersecurity · a timeline from log lines
A timeline from three log lines
A timeline is the events in time order with the times written next to them, normally in UTC -- universal time, coordinated -- so that logs from machines in different places line up, and it is what turns a pile of log lines into a story somebody can act on.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
In beta. This lesson was written for Hone and has not yet been checked by a practising security analyst. Practice material, not professional advice. What that means.
What it is for
The manager does not want the logs. She wants one paragraph: at this time somebody tried, at this time they got in, at this time they made themselves a second account. The timeline is what the after-action report is built from and what the lawyers read.
How to think about it
Sort by time first, before you interpret anything. Put the times in one time zone. Then write one short sentence per line, and read the sentences in order: the gaps between them are as interesting as the lines themselves.
Worked example
02:14:07 failed password for admin from 203.0.113.24Somebody trying.
02:14:39 accepted password for admin from 203.0.113.24Thirty-two seconds later, they are in.
02:19:02 user admin created account svc-backupFour minutes and twenty-three seconds after that, a second way in for later.
The sentence: tried at 02:14:07, in at 02:14:39, second account at 02:19:02One line each, in order, with the times kept.
Your turn
Write what you sort the log lines by before you read them as a story.
sort by
Solve one, graded on the server
The trap
Mixing time zones. One machine in local time and one in UTC will put the break-in before the attempt, and a timeline in the wrong order is worse than no timeline.