Network Security Logs คืออะไร?
Network Security Logs คือบันทึกเหตุการณ์ (Event Records) ที่เกิดขึ้นในระบบและเครือข่าย เกี่ยวกับกิจกรรมด้านความปลอดภัย ใช้สำหรับ Detection, Investigation, Compliance, Forensics, Auditing
ประเภท Log หลักใน Cyber Security
| ประเภท Log | แหล่งที่มา (Source) | ข้อมูลสำคัญ | Use Case |
|---|---|---|---|
| Firewall Logs | Next-Gen Firewall (Palo Alto, FortiGate, Check Point, Azure FW, AWS Network Firewall) | Source/Dest IP, Port, Protocol, Action (Allow/Deny), App ID, User, Threat ID, URL Category, Bytes, Packets | Traffic Analysis, Blocked Connections, C2 Detection, Policy Tuning |
| IDS/IPS Logs | Snort, Suricata, Zeek, Cisco Firepower, Proofpoint | Alert Signature (SID), Severity, Packet Headers, Payload Snippet, Flow Info | Intrusion Detection, Exploit Attempts, Malware Traffic, False Positive Tuning |
| Proxy / SWG Logs | Zscaler, Netskope, Blue Coat, Squid, Cisco WSA | User, URL, Category, Action, File Hash, MIME Type, SSL/TLS Info, DLP Matches | Web Threat Detection, Data Exfiltration, Shadow IT, Policy Enforcement |
| DNS Logs | DNS Server (AD DNS, Infoblox, Cisco Umbrella, Cloudflare, Azure DNS) | Query Domain, Query Type, Response Code, Client IP, Response IP, TTL | C2 Detection (DGA, Fast Flux), Malicious Domains, Data Exfil via DNS, Typosquatting |
| VPN / ZTNA Logs | VPN Gateway, Zscaler ZPA, Cloudflare Access, Tailscale, OpenVPN | User, Device, Source IP, Assigned IP, Connect/Disconnect Time, Duration, Bytes, MFA Status | Remote Access Monitoring, Impossible Travel, Unauthorized Access, Device Health |
| Authentication Logs | AD Domain Controllers (Security Event Log), Azure AD/Entra ID, Okta, Duo, RADIUS | Event ID 4624/4625/4768/4769/4770/4771, User, Logon Type, Failure Reason, MFA Result | Brute Force, Password Spray, Kerberoasting, Golden Ticket, Account Takeover |
| Endpoint Logs (EDR/XDR) | CrowdStrike, SentinelOne, Defender for Endpoint, Cortex XDR, Elastic Agent | Process Tree, File Hash, Network Connections, Registry Changes, Command Line, MITRE ATT&CK Tags | Malware Execution, Lateral Movement, Persistence, Privilege Escalation, Fileless Attacks |
| Application Logs | Web Apps (Apache, Nginx, IIS), API Gateway, Database, Custom Apps | Request/Response, User Session, Errors, SQL Queries, Business Logic Events | App-layer Attacks (SQLi, XSS, RCE), Business Logic Abuse, Fraud Detection |
| Cloud/Infrastructure Logs | AWS CloudTrail, VPC Flow Logs, Azure Activity Log/NSG Flow Logs, GCP Audit Logs | API Calls, Resource Changes, Network Flows, IAM Changes, Security Group Modifications | Cloud Misconfig, Privilege Escalation, Data Access, Compliance Drift |
| Email Security Logs | Proofpoint, Mimecast, Microsoft Defender for Office 365, Cisco ESA | Sender/Recipient, Subject, Attachment Hash, Verdict (Malware/Phish/Spam/Clean), URLs, SPF/DKIM/DMARC | Phishing Campaigns, BEC, Malware Delivery, Account Compromise |
| IoT/OT Logs | IoT Gateways, PLCs, Historians, SCADA (Dragos, Claroty, Nozomi) | Device ID, Protocol (Modbus, DNP3, OPC UA), Command/Response, Anomaly Scores | OT Threat Detection, Process Anomaly, Safety System Integrity |
ทำไม Log จึงสำคัญสำหรับ Security?
- Detection: หา Anomalies, IOCs, Attack Patterns (MITRE ATT&CK)
- Investigation: Root Cause Analysis, Timeline Reconstruction, Scope Determination
- Compliance: PCI-DSS (1 year), HIPAA (6 years), GDPR, ISO 27001, SOX - ต้องเก็บ Logs
- Forensics: Evidence Chain, Legal Proceedings, Attribution
- Threat Hunting: Proactive Search สำหรับ Threats ที่ SIEM ไม่จับ
- Baseline & Tuning: รู้ "Normal" คืออย่างไร เพื่อลด False Positives
Log Management Best Practices (2024)
- Centralized Logging: ส่งทุก Log ไป SIEM/Log Platform เดียว (Splunk, Elastic, Sentinel, Chronicle, Loki, OpenSearch)
- Structured Logging (JSON): ง่ายต่อ Parsing, Query, Correlation
- Enrichment: เพิ่ม Context (GeoIP, ASN, Threat Intel, Asset Owner, User Identity, MITRE Tags)
- Retention Policy: Hot (30-90 days, SSD), Warm (1-2 years, Object Storage), Cold/Archive (7+ years, Glacier/S3 IA) ตาม Compliance
- Normalization (CIM/ECS/OCSF): มาตรฐาน Field Names เพื่อ Query ข้าม Source ได้
- Selective Logging: ไม่ Log ทุกอย่าง (Noise, Cost) → Log Security-relevant Events, Metadata, Sampled Flows
- Integrity Protection: Immutable Storage (WORM), Hash Chains, Blockchain Anchoring, Signed Logs
- Access Control: RBAC บน Log Platform, Encryption At Rest/In Transit, Audit Log Access
Log Sources ที่ควรส่งเข้า SIEM (Priority)
- Firewall (Allow + Deny)
- Authentication (DC, IdP, MFA, VPN)
- Endpoint (EDR/XDR)
- DNS (Internal Resolver, Protective DNS)
- Proxy/SWG
- Email Security
- Cloud (CloudTrail, VPC Flow Logs, Azure NSG Flow Logs)
- Application (Critical Apps, WAF)
- Network Devices (Switch, Router, Load Balancer - Syslog/SNMP)
- Vulnerability Scanner Results
SIEM Query Examples (KQL / Splunk SPL)
// KQL (Sentinel) - Failed Logons with Source IP Count
SecurityEvent
| where EventID == 4625
| summarize FailedCount = count() by IpAddress, Account
| where FailedCount > 10
| sort by FailedCount desc
// SPL (Splunk) - Potential Data Exfil Large Upload
index=firewall action=allow bytes_out>100000000
| stats sum(bytes_out) as TotalBytes by src_ip, dest_ip, app
| where TotalBytes > 100000000
สรุป
Network Security Logs เป็น "สายตาและหู" ของ SOC โดยไม่มี Log ที่ดีพอ SIEM/SOAR/Analyst ก็ทำงานไม่ได้ จำเป็นต้องมี Centralization, Structured Format, Enrichment, Proper Retention, Integrity Protection และ Selective Collection เพื่อ Cost-effectiveness
