Log Management &

Data Normalization
Course SOC Analyst for Beginners

Muhamad Mahrus Qusaeri - BTL 2, CCNP, NSE 7, MTCINE, JNCIS-Sec [Link]/in/mahrusq

SOC Analyst for Beginners
 Our Journey to become an SOC Analyst

We are here !

Log Management & Incident Detection & Cyber Threat Basic of Digital Alert Triaging & Automation &
Pengantar SOC Ticketing System
Data Normalization Response Intelligence Forensics Prioritization Reporting

1 2 3 4 5 6 7 8

SOC Analyst for Beginners

 Agenda
• Konsep Dasar Logging
• Log Management tools
• SIEM
• Data Normalization

SOC Analyst for Beginners SOC Analyst for Beginners

Why Log Management
• Sistem deteksi security pada dasarnya bekerja dengan cara mengumpulkan log
dan mencari pattern / pola anomaly lalu muncul alert
• SOC Analyst bertugas memonitoring alert yang muncul, menganalisa alert
tersebut, menentukan apakah alert ini beneran serangan (True Positive) atau
hanya aktifitas biasa pada user (False Positive)
• Pada dasarnya semua device (software / hardware) pasti memiliki log dan bisa
dilakukan monitoring, namun tidak semua log cocok dimonitoring oleh SOC

SOC Analyst for Beginners SOC Analyst for Beginners

How SOC Analyst Uses Logs Daily

Searching through Logs

Security Alert ❑ Analyze pattern Decide: Benign / Suspicious
❑ Gathering context
❑ Validating attack

Enrichment via CTI

SOC Analyst ❑ IP/Domain Reputation
❑ Malware Analysis
Report
❑ Threat Actor Attribute

SOC Analyst for Beginners SOC Analyst for Beginners

Konsep Dasar Logging

SOC Analyst for Beginners SOC Analyst for Beginners

Event vs Log
• Event: kejadian (login sukses/gagal, file dibuat, koneksi dibuka)
• Log: catatan event + metadata (timestamp, user, host, dll)

Event Log

Percobaan login ssh • Jan 11 10:15:32 server-01 sshd[24567]: Failed password for invalid user admin from
ke server [Link] [Link] port 53421 ssh2

• [Link] - - [11/Jan/2026:10:25:41 +0700] "GET /[Link]?username=admin' OR

Login berhasil '1'='1&password=abc HTTP/1.1" 200 532 "-" "Mozilla/5.0"

SOC Analyst for Beginners SOC Analyst for Beginners

Why Logging is important
• Security event detection / alerting
• Creating Investigation timeline
• Threat Hunting
• Compliance
• Troubleshooting

SOC Analyst for Beginners SOC Analyst for Beginners

Cara log dikirim (collection method)
Method Pros Cons
Agent-based detail, stabil, bisa enrichment butuh maintenance
Agentless (syslog, WMI, cepat deploy kadang field terbatas, rate
cloud logs) limit

SOC Analyst for Beginners SOC Analyst for Beginners

Log Types Based on Function
• Authentication/Authorization logs (login,
token, privilege)
Based on Sources • Network connection logs (src/dst, port,
• Endpoint log action allow/deny)
• Network log • Process & execution logs (parent/child,
command line)
• Identity & Access log • File/registry/config changes
• Application log • Web request logs (URI, status code, user-
• Cloud log agent)
• Security log • Audit logs (siapa melakukan apa)
• Error logs (crash, exception)

Common questions Log Source

User X login dari mana? Identity, VPN, Endpoint
Apakah ada malware yang running? AV, EDR, Sysmon
Kapan percobaan scanning web dilakukan? Web Access log, Firewall, IDS Log

SOC Analyst for Beginners SOC Analyst for Beginners

Log Management tools

SOC Analyst for Beginners SOC Analyst for Beginners

Log Management tools
• Aplikasi / Platform yang dapat menerima log,
melakukan parsing dan menyimpan kedalam storage
(indexing) sehingga user dapat dengan mudah
melakukan searching
• Contoh:
❖ Graylog, Splunk, ELK, Datadog, Solarwinds

SOC Analyst for Beginners SOC Analyst for Beginners

SIEM
• Security Information & Event Management: Sebuah Log Management tools yang
dapat mengkorelasikan suatu kejadian berdasarkan beberapa sumber log untuk
mendeteksi serangan siber
• Komponen utama SIEM:
❖ Log Collector
❖ Parser/Decoder
❖ Visualization
❖ Alerting
❖ Storage

SOC Analyst for Beginners SOC Analyst for Beginners

SIEM vs Log Management
• Perbedaan antara SIEM dengan log management
biasa adalah terletak dari “insight apa yang bisa
diberikan”
• SIEM fokus pada security event, Incident
workflow, visualization
• Log Management fokus pada pengelolaan log
secara general (network, server, application, dll.)
• SIEM = Log Management yang bisa deteksi
serangan siber

SOC Analyst for Beginners SOC Analyst for Beginners

Data Normalization

SOC Analyst for Beginners SOC Analyst for Beginners

Why we need Normalization?

• Sebuah log perlu dilakukan normalisasi supaya field nya standar

• Field yang standar dapat memudahkan dalam pembacaan log
• Log mudah dibaca = hasil Analisa lebih baik

SIEM will
Field Storage /
Log Ingested parsing the Correlation Alerting
Normalization Indexing
log

SOC Analyst for Beginners SOC Analyst for Beginners

Normalization Example {
"@timestamp": "2026-01-11T10:15:22Z",
"[Link]": "authentication",
"[Link]": "login",
Raw Log "[Link]": "failure",
"[Link]": "4625",
"[Link]": "johndoe",
• Windows login Log "[Link]": "[Link]",
"auth.logon_type": 3,
EventID=4625 "[Link]": "windows"
Account Name: johndoe }
Source Network Address: [Link]
Logon Type: 3
Failure Reason: Unknown user name or bad password {
"@timestamp": "2026-01-11T10:15:23Z",
TimeCreated: 2026-01-11 10:15:22
"[Link]": "authentication",
"[Link]": "login",
"[Link]": "failure",
"[Link]": "johndoe",
• Linux Auth log "[Link]": "[Link]", Structured &
"[Link]": 54321,
"[Link]": "ssh", Normalized
"[Link]": "server1"
Jan 11 10:15:23 server1 sshd[1234]: Failed password for
}
johndoe from [Link] port 54321 ssh2

{
"@timestamp": "2026-01-11T10:15:24Z",
• Firewall log "[Link]": "network",
"[Link]": "connection",
"[Link]": "failure",
"[Link]": "[Link]",
date=2026-01-11 time=10:15:24 action=deny src=[Link] "[Link]": "[Link]",
dst=[Link] service=SSH "[Link]": "ssh"
}

SOC Analyst for Beginners SOC Analyst for Beginners

Common Logging Mistake
• Timestamp beda timezone mengakibatkan waktu saat ini dengan waktu log
tidak sinkron
• Source IP kosong / salah field mengakibatkan data tidak terparsing dengan baik
• Semua log di-ingest tanpa filtering dapat membuat a lot of noise. Semakin
banyak noise semakin sulit untuk dianalisa

SOC Analyst for Beginners SOC Analyst for Beginners

Tugas dirumah #1
1 – Log from Windows
• Diberikan 3 raw log
• Jawab dalam dokumen pdf, submit di link submission yang sudah EventID=4624
disediakan Account Name: johndoe
Logon Type: 3
Source Network Address: [Link]
2 – Log from Firewall Workstation Name: CLIENT-01
TimeCreated: 2026-01-11 10:30:15
date=2026-01-11 time=10:33:10 action=allow src=[Link] dst=[Link] service=SSH

Jan 11 10:32:01 server1 sudo: johndoe : TTY=pts/0 ; PWD=/home/johndoe ; USER=root ; COMMAND=/bin/cat /etc/shadow
3 – Log from Linux

• Instruksi:
1. Normalize field yang sama dan muncul di beberapa log source, format
json
2. Interpretasikan log tersebut
✓ Itu log apa?
✓ Artinya apa?
✓ Harus action apa?

SOC Analyst for Beginners SOC Analyst for Beginners