Glossary: Logs and Data Sources for Investigations

Authentication log

Also written: authentication logs, auth.log, sign-in log

A record of every attempt to prove an identity: who tried, from where, with which method, and whether it worked. On Linux, SSH writes to /var/log/auth.log.

Where the book teaches it

Chapter 1: Application, Authentication, Communication and Audit Logs
Chapter 3: Scans, Reports, Flow Records and Footage
Chapter 4: Security Tools, Dashboards, Packet Captures and Integrity
Chapter 5: System Images, Stakeholders and Log Parsing

Related terms

Password spraying Brute force Windows Security event IDs sshd