The What2Log Blog

Event ID 4672: Special Privileges Assigned to a New Logon

In gathering the information for W2L, I noticed the number of things that Windows 10 (in particular) logs and how some of these logs make almost no sense at first. One of these logs in particular was the log that is associated with Event ID 4672. I was curious as

The Struggle Is Real: Event Correlation with Logs

Event Correlation is a key step in looking at security incidents, they allow different logs to be brought together to get the full picture of what happened in an incident. It is the process of analyzing the log files from a network and finding the ones that were apart of

The Struggle Is Real

The Struggle is Real: To Aggregate or Not to Aggregate

That is the question. Log aggregation is the practice of consolidating all of a networks logs into one "container" to make them more easily searchable. It is important to note that this is not a guide to log aggregation tools, as plenty of those exist already. This is simply a

The Struggle Is Real

The Struggle is Real

This "series" hopes to talk about some of these issues a little more in depth and help get you thinking about what can be done to help fight these issues. After all, the struggle is real.

Welcome to What2Log

What2LogWhat2Log started out as a passion project when we noticed a pretty major gap in information surrounding computer logging. We all know that logging is important for a variety of reasons and not just in the wake of an attack, so this lack of information was pretty eye-opening. We decided