Security log analysis parses, normalizes, and correlates log data from multiple sources to identify threats, investigate incidents, and meet compliance requirements.
Key log sources: Windows Security events, Syslog, firewall/IDS logs, web server logs, DNS logs, authentication logs (AD/RADIUS). Normalize timestamps (UTC). SIEM aggregates and correlates. Analysts write SPL/KQL queries for investigation.