Windows Event Logs- TryHackMe lab

This week I am working on the Windows Events room by Tryhackme.

Per Wikipedia, “Event logs record events taking place in the execution of a system to provide an audit trail that can be used to understand the activity of the system and to diagnose problems. They are essential to understand the activities of complex systems, particularly in applications with little user interaction (such as server applications).”

The image above shows some capabilities of a SIEM (Security information and event management). This is a system that can collect logs from many systems to view them in one place. When hackers perform malicious actions on a system, they often clear the logs to prevent detection. If the logs are sent to a SIEM, you may still get the logs that show their actions. You will also have a much easier time viewing the logs in one place rather than on each system individually.

In Windows, there are 5 types of events that can be logged:

• Error
• Warning
• Information
• Success Audit
• Failure Audit