Build the telemetry inventory your incident will need

applied · 90 min · Objective 1.1

Task

Produce, for your whole lab, the document an incident responder actually wants on day one: every log source, what it can answer, how far back, and where the holes are. Objective 1.1 is the system and network architecture an analyst works inside, and this is that architecture written down as capability rather than as a diagram.

Steps

  1. Enumerate every log source you have, including the ones you forgot: system, authentication, process creation, PowerShell, web server, firewall or connection logs, the collector's own logs, and the hypervisor's.
  2. For each, record five columns: source name, the host, what questions it can answer, the oldest record present, and whether it is shipped off the host or only local.
  3. Now test the inventory rather than trusting it. For each source, run one query that should return data and confirm it does.
  4. Write five realistic questions an incident would ask -- which account created this user, what did this process do, what did this host connect to last Tuesday, who logged in from where, what changed in the registry -- and for each, name the source that answers it and confirm you can.
  5. Mark every question you cannot answer. For each, decide: enable a source, extend retention, or accept and record the gap.
  6. Deliberately turn off one source and re-run step 4. Note which questions silently changed from answerable to unanswerable with no error anywhere.

Verify

for f in /var/log/collected/*; do printf "%-40s %8s lines  oldest %s\n" "$f" "$(wc -l < "$f")" "$(head -1 "$f" | cut -c1-15)"; done
find /var/log/collected -type f -mmin -15 | wc -l
find /var/log/collected -type f | wc -l

The table is the inventory, produced from what is actually on disk rather than from what you believe is configured. The last two numbers must be equal: every source that exists must have written recently. A source present in the inventory and absent from the fresh count is the exact failure this lab is for.

Notes

The five-question test is the part worth keeping. A log source list is a procurement document; a list of questions you can answer is a capability statement, and only the second survives contact with an incident.

Store the retention figures. Lesson 29's readiness lab compares against them, and lesson 40's metrics lab uses them as the coverage denominator.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.