How do you read a security log?
Start by identifying the timestamp, event type, source, user, IP address, severity and action. Then compare related events to understand what happened before and after the suspicious activity.
A single log entry rarely tells the whole story. Log analysis is usually about recognizing patterns across multiple events.
What is a security log?
A log is a record generated when a system, application, device or service performs an action or observes an event.
Security analysts use these records to reconstruct activity and identify behavior that may indicate a security incident.
2026-08-13 14:22:08 | LOGIN_FAILED | user=admin | src=192.0.2.18
This single entry already gives an analyst several useful fields: time, event type, username and source address.
Why security logs matter
Security incidents often leave traces across several systems. Logs help investigators connect those traces.
- Detect suspicious login behavior.
- Trace access to sensitive resources.
- Identify malicious IP addresses.
- Investigate malware or command execution.
- Reconstruct the timeline of an incident.
An isolated event may be harmless. A sequence of unusual events may reveal a much larger problem.
Common types of security logs
Analysts encounter logs from many different sources. Each source reveals a different part of system activity.
Login activity
Successful and failed logins.
Connections
Source, destination and ports.
HTTP requests
Paths, responses and clients.
Other common sources include endpoint logs, DNS logs, firewall events, cloud audit logs, application logs and antivirus or EDR alerts.
Understand timestamps first
Time is one of the most important fields in any investigation because analysts use timestamps to build an incident timeline.
Always check whether the log uses local time, UTC or another configured timezone.
2026-08-13T09:15:42Z
The Z suffix commonly indicates UTC. Mixing timestamps from different timezones without normalizing them can make an investigation appear out of order.
Read IP addresses and user activity
IP addresses help analysts understand where an event originated and where traffic was going.
LOGIN_SUCCESS user=alex src=203.0.113.44 dst=10.0.0.12
Analysts compare IP activity with normal user behavior, geographic expectations, previous events and threat intelligence.
Investigate failed login attempts
A few failed logins are normal. Large numbers of failures or unusual patterns deserve more attention.
250 failed login attempts from one source IP in 3 minutes
Analysts may investigate whether the activity resembles brute force, password spraying, credential stuffing or a legitimate user repeatedly entering the wrong password.
Look at what happens after the failures. A successful login immediately following many failed attempts can be especially important.
Read web and HTTP logs
Web server logs often record the requested path, client address, request method, status code and user agent.
203.0.113.55 GET /admin/login 401
The HTTP status code provides an immediate clue about the result.
- 200: request succeeded.
- 301 / 302: redirect.
- 401: authentication required or failed.
- 403: access forbidden.
- 404: resource not found.
- 500: server-side error.
Recognize suspicious patterns
SOC analysts rarely investigate events based only on one field. They look for combinations of activity that differ from normal behavior.
- Repeated failed authentication.
- Access at unusual times.
- One account logging in from several distant IPs.
- Sudden privilege changes.
- Requests for sensitive or administrative paths.
- Large bursts of outbound connections.
The value comes from connecting these events into a coherent story.
Look for indicators of compromise
Indicators of compromise, often shortened to IOCs, are observable values associated with potentially malicious activity.
- Suspicious IP addresses.
- Malicious domains.
- File hashes.
- Unusual URLs.
- Unexpected process or file names.
Analysts should validate indicators in context rather than treating every matching value as a confirmed compromise.
How SOC analysts investigate logs
A basic investigation often follows a repeatable workflow.
- Identify the alert or suspicious event.
- Confirm the affected user, host or service.
- Review events before and after the alert.
- Extract relevant IP addresses, domains and hashes.
- Compare the activity with expected behavior.
- Determine severity and possible impact.
- Document findings and recommended action.
More advanced investigations may correlate data across SIEM platforms, endpoint tools, identity systems, network telemetry and threat intelligence.
Analyze logs with ThreatHawk
Reading individual entries manually is useful for learning, but larger datasets quickly become difficult to review line by line.
Automated analysis can help surface severity, suspicious patterns and recurring indicators.
Inspect security logs directly in your browser.
ThreatHawk Log Analysis can process supported log data, highlight severity, summarize suspicious activity and extract indicators such as IP addresses for faster investigation.
Final takeaway
Reading security logs is less about memorizing every possible event code and more about learning how to recognize relationships between time, users, systems, addresses and actions.
Start with simple fields, build a timeline and look for behavior that does not fit the expected pattern. That same process scales from beginner exercises to real SOC investigations.
Security log analysis FAQ
What should I look at first in a security log?
Start with the timestamp, event type, user, source and destination information. These fields usually provide the initial context needed to understand an event.
Are failed login attempts always malicious?
No. Users frequently mistype passwords. Analysts look at volume, timing, source addresses, targeted accounts and what happens afterward before deciding whether failures are suspicious.
What does a SOC analyst use logs for?
SOC analysts use logs to detect suspicious behavior, validate alerts, reconstruct incidents, extract indicators and determine the scope and impact of security events.
What is an indicator of compromise?
An indicator of compromise is an observable value such as an IP address, domain or file hash that may be associated with malicious activity.