Log analysis is the real reason logs are collected and without it, there really isn't a point to collecting logs. Log analysis is what allows for events to be found and understood. As a whole, analysis can pose quite a few challenges from several different directions, but it is a

Event Record ID is a hidden (more on this later) feature in the Windows Event Logs that serves to further enrich the information of logs. The Event Record IDThe Event Record ID should not be confused with the Event ID. Event IDs are the identifying numbers that we talk about

One thing I learned very early on, even before What2Log, was that there are a lot of logs and that computers generate a lot of logs. What2Log was made to help parse some of the information from these logs and make them less daunting, because that is often how they

In gathering the information for W2L, I noticed the number of things that Windows 10 (in particular) logs and how some of these logs make almost no sense at first. One of these logs in particular was the log that is associated with Event ID 4672. I was curious as

What2LogWhat2Log started out as a passion project when we noticed a pretty major gap in information surrounding computer logging. We all know that logging is important for a variety of reasons and not just in the wake of an attack, so this lack of information was pretty eye-opening. We decided