CYBRARY From log record to alert
Where records come from, what a rule is, and why the same rule behaves differently on two estates.
By the end you can
- Name the main record sources on Windows and Linux.
- Describe what a detection rule matches on.
- Explain why tuning is part of writing a rule, not an afterthought.
Where records come from
Windows writes to channels — Security, System, Application, and the Sysmon operational channel if it is installed — each record carrying an event id. Linux writes to the journal and to syslog files under /var/log, each line carrying a facility and a severity.
A SIEM does one simple thing well: it collects those records from many machines into one searchable index, and runs rules over them as they arrive.
- Windows Security 1102 — the audit log was cleared.
- Windows System 7045 — a new service was installed.
- Windows Security 4688 / Sysmon 1 — a process started, with its parent.
- Linux journal — unit started, sudo decision, SSH accepted or failed.
What a rule is
A rule is a match plus a meaning. The match is mechanical — these event ids, this text pattern, this count in this window. The meaning is the part a human wrote: what it implies, how urgent it is, and what to do next.
A rule without the second half produces alerts nobody can action, which is how a console becomes wallpaper.
Rules the range runs
These are real scenario rules from the product lines, not examples.
| Rule | Source and signal |
|---|---|
| Lookalike sign-in domain clicked (high) | mail gateway · A click-through to a domain registered inside the last 30 days. |
| Sign-in from an address this account has never used (high) | directory audit · Successful logon from a source outside the account's 90-day history. |
| Share enumeration from a workstation (medium) | endpoint agent · One host opening shares it has no history of opening. |
| Office application spawned a shell (critical) | endpoint agent · WINWORD.EXE or EXCEL.EXE as the parent of powershell.exe or cmd.exe. |
| Scheduled task registered outside a change window (high) | endpoint agent · Task registration by a user account with no change record. |
| Beacon cadence to a young domain (high) | network sensor · Same-size POSTs at a regular interval with low jitter. |
| Service ticket requested with weak encryption (high) | directory audit · RC4 service tickets for accounts that never interactively log on. |
| Admin share opened by a service account (high) | endpoint agent · ADMIN$ or C$ opened by an account with no interactive history. |
| Shadow copies deleted (critical) | backup service · vssadmin or wbadmin removing recovery points. |
| Run key written to a user-writable path (high) | endpoint agent · HKCU Run value whose data points at ProgramData, Temp or AppData. |
| Service installed with a suspicious image path (high) | endpoint agent · 7045 where the image path is outside Program Files or System32. |
| Hidden PowerShell launched by the task engine (high) | endpoint agent · taskeng.exe or svchost as the parent of powershell -w hidden. |
Check yourself
Windows event 1102 means…
A rule that matches correctly but fires 400 times a day on normal work is…