5 Logs You Should Be Watching (But Probably Aren't)

August 30, 2026 · 8 min read · Log MonitoringThreat Detection

Most companies collect logs. Few companies actually look at them.

You've got a SIEM (or just syslog) collecting gigabytes of noise, but when an incident happens, nobody knows what to check.

Here are 5 logs that actually matter — and what to look for. Each takes under 15 minutes to set up alerts for.

Most

attacks can be caught with just these 5 log sources

1. Failed Authentication Attempts

Why it matters: Brute force attacks, credential stuffing, and compromised accounts all show up here first.

What to Watch For

  • 10+ failed logins from the same IP in 5 minutes → brute force attempt
  • Failed logins followed by success from unusual location → credential compromise
  • Multiple failed logins for admin/service accounts → targeted attack

Where to Look

  • Windows: Event ID 4625 (failed logon)
  • Linux: /var/log/auth.log or /var/log/secure
  • Firewall/VPN: Authentication failure logs
  • Active Directory: Event ID 4771, 4776 (Kerberos/NTLM failures)
Quick win: Set up an alert for 10+ failed auth attempts from any single source in 10 minutes.

2. Firewall Denies (Outbound Traffic)

Critical insight: Malware trying to call home shows up as outbound blocks — not inbound.

Most people only watch inbound blocks. The real threat is inside your network trying to get out.

What to Watch For

  • Repeated outbound denies to the same destination → C2 beacon attempts
  • Outbound traffic on unusual ports (not 80/443) from workstations
  • DNS queries to suspicious domains (especially with DGA patterns)
  • Any outbound traffic from servers that shouldn't initiate connections

Where to Look

  • Firewall block/deny logs
  • Filter for: action=deny direction=outbound
Quick win: Create a dashboard showing top 10 denied outbound destinations. Anything repeating every few minutes? That's malware.

3. Account Creation & Privilege Changes

Why it matters: Attackers create backdoor accounts or elevate existing ones. If you're not watching, you won't notice until it's too late.

What to Watch For

  • New user accounts created (especially outside business hours)
  • Users added to admin/privileged groups
  • Service accounts created without a change ticket
  • Password resets for admin accounts

Where to Look

  • Windows Active Directory: Event ID 4720 (user created), 4728 (user added to group)
  • Linux: /var/log/auth.log — look for useradd, usermod
  • Cloud: Azure AD audit logs, AWS CloudTrail
Quick win: Set up an alert for any account added to Domain Admins, Enterprise Admins, or local Administrators group.

4. Large File Transfers (Outbound)

Why it matters: Data exfiltration looks like legitimate traffic — but it's a lot of legitimate traffic going to places it shouldn't.

What to Watch For

  • Large uploads to cloud storage services (Dropbox, Google Drive, OneDrive — if not corporate-managed)
  • FTP/SFTP outbound from workstations (why does marketing need to FTP anywhere?)
  • DNS tunneling (huge DNS queries with encoded data)
  • Unusual upload volume from a single user or system

Where to Look

  • Firewall session logs (sort by bytes transferred)
  • Web proxy logs (filter for file-sharing sites)
  • NetFlow/sFlow data (look for top talkers)
Quick win: Baseline your normal upload traffic. Alert on anything 3x over baseline from a single host.

5. Configuration Changes on Critical Systems

Why it matters: If someone changes a config on a firewall, switch, or domain controller, you need to know immediately.

Attackers disable logging, open firewall rules, create persistence mechanisms. All of this shows up in config change logs.

What to Watch For

  • Firewall rule additions/changes
  • Router/switch ACL changes
  • Group Policy modifications (GPO changes in AD)
  • Critical file modifications (e.g., /etc/passwd, /etc/sudoers)
  • Security tool disablement (antivirus, EDR turned off)

Where to Look

  • Network devices: Enable archive command (Cisco) or logging of config changes
  • Windows: Event ID 4719 (system audit policy changed), 5136 (AD object modified)
  • Linux: auditd logs for file changes on sensitive paths
Quick win: Set up alerts for any firewall rule change. Even if it's legitimate, you should know about it.

What These 5 Logs Cover

Credential Abuse

Failed authentication attempts

Malware Activity

Outbound firewall denies

Privilege Escalation

Account & permission changes

Data Theft

Large file transfers

Persistence

Configuration changes

How to Actually Set Up Alerts

Here's the thing: collecting logs is easy. Acting on them is hard.

Don't try to manually review logs daily. You'll burn out in a week.

Instead, follow this process:

  1. Pick one log source from the list above
  2. Set up a basic alert (10 failed logins, new admin account, etc.)
  3. Test it (trigger a false positive intentionally)
  4. Tune the alert over 2 weeks (reduce noise, don't silence everything)
  5. Move to the next one

In a month, you'll have 5 solid alerts that actually tell you when something's wrong.

Need Help with Security Monitoring?

Check out our security audit checklist and monitoring guides — practical templates for building real detection capabilities.

View Templates

Comments

Comments are moderated. Practical questions and insights are welcome!

By posting, you agree to the Privacy Policy and Terms. Comments on this page are stored only in your browser.

R
Robert Just now

Thanks for reading! Drop your questions or share which log source you're implementing first. I read all comments and reply to questions.