← detection engineer

Logs, Events & Schemas — The Raw Material of Detection

beginner 3h

Read raw EVTX, syslog, and JSON cloud audit logs; articulate why ECS/OCSF exist; and map fields across schema standards.

After this module you will

  • › Distinguish structured from unstructured logs and identify canonical fields
  • › Parse Windows Event Log XML schema, providers, and channels
  • › Read cloud audit logs across CloudTrail, Azure Activity, and GCP Audit
  • › Explain why schema unification (ECS, OCSF, CIM) exists
  • › Map the same event across Splunk CIM, Elastic ECS, and OCSF field sets

Lessons

1 What Is a Log? Structure, Timestamps, Canonical Fields
25 min
2 Windows Event Logs — EVTX, XML Schema, Providers, Channels
25 min
3 Cloud Audit Logs — CloudTrail, Azure Activity, GCP Audit
25 min
4 Schema Unification — ECS, OCSF, and Splunk CIM
25 min
5 Worked Example: One SSH Login, Three Schema Representations
25 min

Module Quiz

Test your knowledge before moving on.

Take Quiz →