Almost everything a computer does leaves a written record: every login attempt, every file accessed, every connection made, every error thrown. These records — logs — pile up by the millions, unread, on every system you'll ever manage. Security work, to a degree that surprises newcomers, is the craft of making that footage useful: knowing what's recorded where, gathering it, and spotting the frames that matter.
The footage analogy, taken seriously
Think of logs exactly as security camera recordings, because the parallels run deep. Cameras don't prevent burglaries — they let you detect one, reconstruct what happened, and prove it afterwards. Footage is only useful if the cameras were actually recording before the incident, pointed at the right places, and kept long enough. And crucially: footage stored inside the building can be stolen or wiped by the burglar. Every one of those sentences translates directly into a principle of security logging — including the last one, which is why serious environments ship logs off each machine to central storage the attacker can't quietly edit. Deleting local logs to cover tracks is a standard attacker move; centralised copies are the counter.
What the everyday footage shows
- Authentication logs — every success and failure. A thousand failures then one success is a brute-force attack narrated in plain text. A user logging in from London and Singapore within an hour is an "impossible travel" alert writing itself.
- Network logs — who connected to what. A workstation suddenly sending gigabytes to an unknown external server at 3am is data theft with a timestamp.
- Endpoint logs — processes started, changes made on each machine. Word launching PowerShell is one of the most classic malicious patterns in existence, and it appears here.
The tool you'll hear about constantly: SIEM
A SIEM (Security Information and Event Management — everyone says "sim") is the central control room: it ingests logs from everywhere, normalises them into a common format, and runs detection rules across the combined stream. Its real power is correlation — no single log line looks alarming, but a failed VPN login, then a success, then a new admin account, then a large outbound transfer, stitched across four systems in twenty minutes, is an intrusion story no individual system could have told. Detection engineering — writing the rules that spot such stories — is an entire career, and this trail has a Summit post on it.
A beginner habit that pays off immediately: when anything odd happens — a lockout, a weird crash, an alert — go find the log line for it. Not because each instance matters, but because you're learning what normal looks like on your systems. Every experienced responder's "that's weird" instinct was built exactly this way, one boring log at a time.
Last, a truth that shapes real budgets: logging is a trade-off. Recording everything forever costs real money (SIEMs often charge by data volume), so organisations choose what to record and how long to keep it — and incident responders regularly discover the one log they needed was never enabled. "What should we log?" is a genuine design question, and now you know why it gets asked.