Introduction
This article will provide information on understanding and detecting threat situations in the logs you analyze in Logsign.
Context
Logsign uses a list structure for detecting abnormal behaviors. An object that satisfies certain conditions is added to the list. The object added to the list is also configured with context information.
Let's explain this with an example.
In the list below;
If a source IP address makes more than 100 post requests within 6 minutes, it will be added to the list. The context information of the IP address added to the list is also marked as Suspicious in all other logs.
As seen in the logs below, we can see that the IP address in the Context.SourceIP and Context.DestinationIP columns has previously been added to a list.
Behavior
You can view columns such as Behavior.SourceIP or Behavior.SourceUserName in the logs, which are provided through log enrichment. The values in the SourceIP or other columns in Behavior indicate that they are present in this list.
In the log example below, we can say that the IP address 192.168.250.184 is in the list of sources accessing a malicious IP address by looking at the Behavior.SourceIP column.