Network Security Logs คืออะไร? ทำไมจึงสำคัญ?
Network Security Logs คือ บันทึกเหตุการณ์ (Event Records) ที่เกิดขึ้นบนอุปกรณ์และระบบเครือข่าย — ประกอบด้วย Timestamp, Source/Destination IP/Port, Protocol, Action (Allow/Deny/Alert), User/Device Identity, Application, Threat Signature, bytes/packets count เป็น Foundation (รากฐาน) ของ:
- Detection: หา Anomalies, IOCs, Attack Patterns (MITRE ATT&CK)
- Investigation/Forensics: Root Cause Analysis, Timeline Reconstruction, Scope Determination
- Compliance/Audit: PCI-DSS, ISO 27001, PDPA, NIST — ต้องมี Log Retention และ Integrity
- Threat Hunting: Proactive Search สำหรับ Threats ที่หลบ Detection Rules
- Baseline/Behavioral Analytics: สร้าง Profile ปกติของ User/Device/App เพื่อ Detect Deviation
ไม่มี Logs = ไม่มี Visibility = ไม่สามารถ Detect/Respond ได้
📊 Log Sources แบ่งตามหมวดหมู่ (Categories) — Priority สำหรับ SIEM Ingestion
Tier 1: Critical — Must Ingest (Priority 1)
| Log Source | Key Data | Use Cases | Format/Protocol |
|---|---|---|---|
| Next-Gen Firewall / Perimeter FW | Traffic Logs (Allow/Deny), Threat Logs (IPS, AV, Spyware, Vulnerability), URL Filtering, File Blocking, SSL Decrypt Logs, User-ID Mapping, Tunnel Logs | Perimeter Visibility, C2 Detection, Data Exfil, Lateral Movement, Compromised Host | Syslog (TCP/TLS), CEF, LEEF, JSON, API (Palo Alto, Fortinet, Check Point, Cisco FTD, Palo Alto Panorama) |
| Proxy / SWG / Cloud Proxy (Zscaler, Netskope, Umbrella, Prisma Access) | Web Transactions (URL, Category, User, Action, Bytes, MIME, Risk Score), SSL Inspection Logs, DLP Incidents, CASB Logs, RBI Logs | Web Threats, Shadow IT, Data Exfil via Web, Cloud App Risk, Phishing Clicks | Syslog, JSON, API, Nanolog (Zscaler), S3/Blob Export |
| DNS Server / DNS Security (Infoblox, Cisco Umbrella, Azure DNS, AWS Route 53 Resolver, BlueCat) | Query/Response (Domain, Type, Response Code, Client IP, RPZ Hits, DGA Detection, Fast Flux, Tunneling) | C2 Beaconing, DGA, DNS Tunneling, Malware Delivery, Domain Reputation, NXDOMAIN Analysis | Syslog, DNS Analytics Logs (JSON), PCAP, API |
| Identity / Authentication (AD, Entra ID, Okta, Ping, RADIUS, TACACS+) | Logon/Logoff (4624/4625/4634/4768/4769/4770/4771/4776), MFA Events, Password Changes, Account Lockouts, Privilege Use, Service Account Activity, Conditional Access | Brute Force, Password Spray, Kerberoasting, Golden Ticket, MFA Bypass, Impossible Travel, Privilege Escalation | Windows Event Log (Forwarded), Syslog, API (Graph API, Okta System Log), RADIUS Accounting |
| Endpoint Detection & Response (EDR/XDR) | Process Execution, File/Registry/Network/Module/DNS/Behavior Events, Alerts, IOCs, MITRE ATT&CK Tags, Sensor Health | Malware Execution, Lateral Movement, Credential Access, Persistence, Defense Evasion, Ransomware | API (CrowdStrike, SentinelOne, Cortex XDR, Defender for Endpoint, Elastic, Tanium), Syslog/JSON Forwarder |
| Email Security Gateway / Cloud Email Security (Proofpoint, Mimecast, Microsoft Defender for Office 365, Google Security, FortiMail) | Message Tracking (Sender/Recipient/Subject/Attachments/URLs), Verdict (Spam/Phish/Malware/BEC/Impersonation), Sandbox Results, Click-time Protection, DMARC/DKIM/SPF Results | Phishing, BEC, Malware Delivery, Credential Phishing, Supply Chain Email Compromise | Syslog, JSON, API, Message Trace Export |
Tier 2: High Value — Strongly Recommended
| Log Source | Key Data | Use Cases |
|---|---|---|
| Network Detection & Response (NDR) / Network Traffic Analysis (NTA) | Flow Records (NetFlow/IPFIX/sFlow), Full Packet Capture (PCAP), Protocol Analysis, Encrypted Traffic Analysis (ETA), Anomaly Scores, Threat Scores | Lateral Movement, C2, Data Exfil, Shadow IT, Protocol Anomalies, Encrypted Threats |
| Cloud Infrastructure Logs (AWS CloudTrail, VPC Flow Logs, Azure Activity Logs/NSG Flow Logs, GCP Audit Logs/VPC Flow Logs) | API Calls (Who/What/When/Where), Network Flows (Src/Dst/Port/Protocol/Action), Resource Changes, IAM Changes, Security Group Changes | Cloud Misconfig, Credential Theft, Crypto Mining, Unauthorized Access, Data Exfil, Compliance Drift |
| VPN / Remote Access / ZTNA (Pulse/Ivanti, Cisco AnyConnect, Palo Alto GlobalProtect, FortiClient, Zscaler ZPA, Cloudflare Access, Twingate, Tailscale) | Connect/Disconnect, User, Device Posture, IP Assigned, Duration, Bytes, Split Tunnel Routes, MFA Events | Unauthorized Access, Geo-impossible Login, Stale Sessions, Data Exfil via VPN, Device Compliance |
| Web Application Firewall (WAF) / API Gateway (AWS WAF, Azure Front Door WAF, Cloudflare WAF, F5 ASM, Imperva, Akamai, ModSecurity) | HTTP Request/Response, Rule Matches (OWASP Top 10, Bot, Rate Limit, Custom), Block/Allow/Challenge/Log Actions, Client Fingerprint | SQLi, XSS, RCE, API Abuse, Bot Attacks, Credential Stuffing, Business Logic Abuse |
| Load Balancer / ADC (F5 BIG-IP, Citrix ADC, AWS ALB/NLB, Azure LB, NGINX, HAProxy) | Client/Server IP, Port, Protocol, TLS Version/Cipher, HTTP Host/URL, Response Code, Latency, Backend Server | DDoS, SSL/TLS Issues, Backend Health, Traffic Anomalies, Certificate Expiry |
| Wireless / NAC (Cisco ISE, Aruba ClearPass, FortiNAC, Mist, Meraki, Ruckus) | Auth Events (802.1X, MAB, Guest), Posture Assessment, Profiler (Device Type/OS), VLAN Assignment, Quarantine, Guest Access | Rogue Devices, Unauthorized Access, IoT Onboarding, Compliance Drift, Guest Abuse |
Tier 3: Contextual / Enrichment — Valuable for Investigation
- Vulnerability Scanner (Nessus, Qualys, Tenable.io, Rapid7, OpenVAS): Scan Results, Asset Inventory, Plugin Output — Enrich Asset Context
- Threat Intelligence Platforms (MISP, OpenCTI, TIP, AlienVault OTX, IBM X-Force, Recorded Future, Anomali): IOCs, TTPs, Campaigns, Actor Profiles — Enrich Alerts
- Asset Inventory / CMDB (ServiceNow, Lansweeper, RunZero, Axonius, Qualys VMDR): Hardware, Software, Owner, Location, Criticality, Business Unit — Enrich Alerts with Context
- HR / Identity Source (Workday, SuccessFactors, AD HR Attributes): Joiners/Movers/Leavers, Termination Dates, Role Changes — Correlation for Insider Threat, Access Reviews
- Physical Security (Badge Access, Camera Systems, Visitor Management): Correlation Physical + Logical Access (Impossible Travel, Tailgating)
- Business Applications (SAP, Salesforce, Oracle, Custom ERP): Privileged Actions, Data Export, Config Changes — Insider Threat, Fraud Detection
- Backup / Recovery Logs (Veeam, Commvault, Rubrik, Cohesity, Azure Backup): Job Status, Ransomware Detection (Anomaly in Backup Size/Entropy), Recovery Tests
- Container/K8s Audit Logs (Kubernetes Audit, Falco, Cilium Tetragon, Sysdig, Aqua, Prisma Cloud): Pod Exec, Privileged Escalation, ConfigMap/Secret Access, Node/Network Policy Changes
📋 SIEM Log Ingestion Strategy: Practical Guidance
1. Prioritization Framework
| Priority | Criteria | Action |
|---|---|---|
| P0 (Immediate) | Perimeter FW, Proxy, DNS, Identity, EDR, Email Security | Ingest First, Full Parsing, Real-time Rules, 90-365 Day Retention |
| P1 (30 Days) | NDR/NTA, Cloud (CloudTrail, VPC Flow), VPN/ZTNA, WAF, LB/ADC, Wireless/NAC | Full Parsing, Key Rules, 30-90 Day Retention |
| P2 (60 Days) | Vuln Scanner, TIP, CMDB, HR, Physical, Business Apps, Backup, K8s Audit | Enrichment/Context, Lookup Tables, Periodic Pull, 30 Day Retention |
2. Parsing & Normalization (Critical for Correlation)
- Common Information Model (CIM) / Elastic Common Schema (ECS) / OpenTelemetry (OTel) / Splunk CIM / Microsoft ASIM — Map Vendor Fields → Standard Fields (src_ip, dest_ip, user, action, severity, MITRE Tactic/Technique)
- ใช้ Vendor-supported Add-ons / Parsers (Splunk TA, Elastic Integrations, Sentinel Data Connectors, Chronicle Parsers) — อย่าเขียน Parser เองถ้ามีให้
- Field Extraction: ต้อง Extract: Timestamp (Normalized to UTC), Source/Dest IP/Port, User Identity, Device/Hostname, Application/Service, Action (Allow/Block/Alert), Threat Name/Category, MITRE ATT&CK Tags
3. Volume & Cost Management
- Filter at Source: Drop Debug/Informational Logs, Drop Health Checks, Drop Known Benign Noise (Windows Update, CDN Health Checks)
- Tiered Retention: Hot (SSD, 30d) → Warm (HDD/Object, 90d) → Cold (Archive/Glacier, 1-7yrs Compliance)
- Sampling (สำหรับ High-volume Low-value): NetFlow/sFlow Sampling (1:1000), DNS Query Sampling (ถ้ามากเกินไป)
- License Optimization: EPS/GB/Day License — Monitor Daily Ingestion vs License, Alert at 80%
4. Log Quality Metrics (ติดตามเป็นประจำ)
| Metric | Target | Action if Breach |
|---|---|---|
| Log Latency (Event Time → SIEM Indexed) | < 5 min (Real-time), < 1 hr (Batch) | Check Forwarder/Collector/Parser/Queue |
| Parsing Success Rate | > 99.5% | Review Parse Errors, Update Parsers |
| Source Availability (Heartbeat) | 100% Critical Sources | Alert on Missing Source > 15 min |
| Field Completeness (Key Fields Populated) | > 95% (src_ip, dest_ip, user, action) | Enrichment Lookup, Source Config Fix |
| Rule Coverage (MITRE ATT&CK Techniques Covered) | > 80% of Relevant Techniques | Develop New Rules, Tune Existing |
🔍 3 Devices/Programs ที่ "ต้องมี" ใน SIEM (Minimum Viable Visibility)
- Perimeter Firewall (Ingress/Egress Traffic + Threat Logs) — มองเห็นใครเข้ามา/ออกไป/โดนบล็อก
- Identity Provider (AD/Entra ID/Okta — Auth Logs) — มองเห็นว่าใคร Login/Failed/Escalated/Used Privilege
- EDR/XDR (Endpoint Telemetry) — มองเห็น Process/Network/File/Registry บน Host — Network + Identity + Endpoint = Triangulation
เพิ่มเติม: DNS, Proxy, Email, Cloud (ตาม Environment)
🛠️ Tools สำหรับ Log Source Management
- Log Forwarders/Collectors: Splunk Universal Forwarder, Elastic Agent/Fleet, Azure Monitor Agent, Google Cloud Logging Agent, AWS Kinesis Firehose, Vector, Fluent Bit, Logstash, Filebeat, NXLog, Syslog-ng, Rsyslog
- Log Source Onboarding Automation: Terraform (SIEM Resources), SOAR Playbooks, Vendor APIs
- Log Quality Dashboard: Splunk SoS/MC, Elastic Observability, Sentinel Workbooks, Chronicle Dashboard, Custom Grafana/Kibana
❓ FAQ
Q: Syslog UDP vs TCP vs TLS — ใช้ตัวไหน?
A: Syslog over TLS (TCP 6514/1468) — Reliable (TCP), Encrypted (TLS), Authenticated (Mutual TLS) — UDP 514 สูญหายได้ (No ACK), ไม่เข้ารหัส — TCP Plaintext ดีกว่า UDP แต่ยังไม่ปลอดภัย
Q: ควรส่ง Raw Logs หรือ Parsed/Normalized ไป SIEM?
A: Raw Logs (Original Format) ไป SIEM ให้ SIEM Parse/Normalize — ยกเว้น Vendor שולח Already Normalized (JSON/CEF) — Raw ให้ Flexibility สำหรับ Re-parsing, Schema Evolution, Forensics
Q: CloudTrail / VPC Flow Logs ส่งไป SIEM ยังไงคุ้มค่า?
A: 1) ส่งเฉพาะ Management Events (CloudTrail) / Reject/Action Flows (VPC Flow) 2) ใช้ Partition/Index แยก (Cheaper Storage) 3) Athena/BigQuery/Lakehouse สำหรับ Long-term Analytics 4) SIEM เฉพาะ High-value Events (Alert-generating)
Q: Log Source Identifier คืออะไร? ตั้งยังไง?
A: Unique Identifier สำหรับแต่ละ Log Source ใน SIEM (QRadar, Splunk, Sentinel) — ตั้งเป็น <vendor>-<type>-<env>-<region>-<instance> (เช่น paloalto-fw-prod-us-east-01) — ใช้ใน Routing, Parsing, Alerting, RBAC
สรุป: Log Sources เป็น เลือด** ของ Security Operations — ต้อง Prioritize Tier 1 (FW, Proxy, DNS, Identity, EDR, Email) ใช้ Standard Schema (CIM/ECS), TLS Transport, Tiered Retention, และ Monitor Log Quality Metrics — เริ่มจาก "Network + Identity + Endpoint" แล้วขยับต่อ
