SIEM
Log Explorer
Search the normalised event store. Use field = value, field contains value, joined with AND / OR.
Field explorer
Top source.type
Saved queries
Query history
- No queries run yet.
8 events
Histogram by hour
Results
| Timestamp | Source | Code | Host | User | Message | Sev |
|---|---|---|---|---|---|---|
| 1970-01-01 08:02:00Z | windows | 4625 | WS-HR-002 | svc_backup | A user account was locked out | info |
| 1970-01-01 06:06:00Z | windows | 4625 | SRV-DC-01 | l.ferreira | A user account was locked out | info |
| 1970-01-01 03:29:00Z | windows | 4625 | WS-HR-002 | l.ferreira | Special privileges assigned to new logon | info |
| 1970-01-01 02:56:00Z | windows | 4625 | WS-HR-002 | l.ferreira | A user account was locked out | info |
| 1969-12-31 16:56:00Z | windows | 4625 | SRV-DC-01 | m.tanaka | Special privileges assigned to new logon | high |
| 1969-12-31 16:07:00Z | windows | 4625 | WS-ENG-231 | d.kusuma | Special privileges assigned to new logon | low |
| 1969-12-31 15:21:00Z | windows | 4625 | WS-HR-002 | a.pratama | An account failed to log on | medium |
| 1969-12-31 11:42:00Z | windows | 4625 | LNX-BUILD-07 | m.tanaka | An account failed to log on | low |
Learn this capability
Hands-on labs that build the technique behind this workspace. Skills transfer to any mainstream SIEM.
Foundation · Guided Lab · 25 min
Reading Windows authentication logs
Overnight the identity team reported 'weird logon noise'. Your job is to go into the raw Windows telemetry and determine whether failed logons on the estate look like normal user error or like an attack pattern.
Entry · Guided Lab · 22 min
Telemetry: the data a SOC actually sees
You have the map; now learn the terrain. Four telemetry families feed this environment — endpoint, network, identity and cloud — and every investigation moves between them.
Intermediate · Guided Lab · 30 min
Normalisation and field mapping
Parsed is not enough. Until the firewall's 'src' maps to source.ip, analysts cannot pivot across sources with one query.