# Log Analysis Strategy

## Phase 1: Source Identification (budget: 15%)
1. Identify available log sources: SIEM, syslog, Windows Event Log, cloud audit trails
2. Determine log format: JSON, CEF, syslog, W3C, custom
3. Check time range coverage and completeness
4. Identify relevant log fields: timestamp, source IP, user, action, status

## Phase 2: Pattern Extraction (budget: 35%)
1. Baseline normal behavior: common source IPs, typical request rates, normal user agents
2. Search for anomalies:
   - Unusual times (off-hours activity)
   - High-frequency events from single source
   - Failed authentication spikes
   - Uncommon user agents or tools
   - Access to sensitive paths (/admin, /api/internal, config files)
3. Correlate across log sources: auth logs + access logs + DNS logs

## Phase 3: Rule Authoring (budget: 35%)
Write detection rules for identified patterns:

### Sigma Rule Template
```yaml
title: [Descriptive title]
id: [UUID]
status: experimental
description: [What is detected and why it matters]
logsource:
  category: [process_creation|network_connection|authentication]
  product: [windows|linux|cloud]
detection:
  selection:
    [field|modifier]: [value]
  condition: selection
falsepositives:
  - [Specific legitimate scenario]
level: [critical|high|medium|low]
tags:
  - attack.tXXXX
```

### KQL Template (Azure Sentinel)
```kql
SecurityEvent
| where TimeGenerated > ago(24h)
| where [field] == [value]
| summarize count() by [grouping]
| where count_ > [threshold]
```

## Phase 4: Validation (budget: 15%)
1. Test rule against known-good log samples (false positive check)
2. Test rule against the suspicious pattern (true positive check)
3. Document tuning recommendations: thresholds, exclusions, log source requirements

## Pivot Triggers
- No anomalies found → expand time range, check additional log sources
- Too many false positives → add specificity: user agent filtering, IP whitelist, time window
- Missing log source → document gap, recommend log collection improvement
