Cyber Security Log Analysis: A Worked Login Timeline
Log analysis starts with a specific question: what happened, to which account or system, and what evidence supports the explanation? This beginner exercise uses fictional authentication events to practise a timeline without needing a paid SIEM.
A log is a record of an event. An alert is a rule or analytic drawing attention to activity. An incident is a security event assessed as requiring response under the organization’s criteria. These terms describe different stages of investigation.
Read the fields before interpreting the pattern
For each event, identify its source, timestamp and timezone, account, host, result and available request or session identifier. Preserve the original timestamp when converting times for a report. Missing records, inconsistent clocks and duplicate ingestion can distort a sequence.
Consult the OWASP Logging Cheat Sheet for guidance on useful event context and protecting logs. Avoid placing passwords, access tokens or unnecessary personal data in a practice report.
Worked example: failures followed by success
All records below are synthetic. The IP addresses are documentation examples. Each timestamp uses UTC; the small dataset is deliberately incomplete.
09:00:01Z account=learner-a src=192.0.2.10 host=lab-app result=failure 09:00:08Z account=learner-a src=192.0.2.10 host=lab-app result=failure 09:00:15Z account=learner-a src=192.0.2.10 host=lab-app result=failure 09:02:40Z account=learner-a src=198.51.100.20 host=lab-app result=success
Observed: three failed authentication records from one source, then a success from a different source for the same account. Not established: whether the same person generated both sets, whether a password was stolen, whether MFA was completed or whether the account performed sensitive actions.
Build a timeline and test explanations
| Possible explanation | Evidence to request |
|---|---|
| The learner mistyped a password, then changed networks. | Authorized user confirmation, device context and usual account activity. |
| An automated process used an outdated password. | Service ownership, application configuration and repeated timing patterns. |
| Someone else attempted or gained access. | Authentication details, session records, MFA events and subsequent actions. |
A different IP is a reason to investigate context, not proof of an attacker. VPNs, shared gateways and mobile networks can affect source addresses. Likewise, a successful authentication does not by itself establish whether the account owner initiated it.
Write a useful investigation note
Case: LAB-LOGIN-01 Scope: Four synthetic lab-app authentication records Observation: Three failures, then a success for learner-a Unknowns: Device, MFA result, session ID and post-login actions Assessment: Suspicious sequence; compromise unconfirmed Next step: Request permitted authentication and session context Owner: Lab reviewer Limit: No endpoint or application-action evidence supplied
The note separates what you observed from what you suspect. In a workplace, follow the approved escalation and response process; do not disable accounts based only on this training pattern.
Optional extension: check an AI-generated timeline
Use only the four synthetic records above for this exercise. Add record labels E1 to E4, then ask an approved AI tool to return a table with the timestamp, account, result and supporting record label. Request a separate list of unknowns; do not ask it to fill missing fields.
Your manual check should still find three failures and one success for learner-a, with no supplied MFA result or post-login activity. Reject any draft that invents a device, location or confirmed compromise. For the learner-b variation, check that the draft keeps the two accounts separate.
Save the input, draft and corrected timeline together. This turns the exercise into evidence of your review skills. To explore this specialist learning path after log-analysis foundations, see AI for Cybersecurity Training in Vizag.
Check your work
- Count the raw records and confirm you did not silently remove duplicates.
- Retain source and timezone details with the timeline.
- List at least two plausible explanations.
- Name the missing evidence that would change your assessment.
- Explain the next action without claiming certainty you do not have.
For a second exercise, change the successful-login account to learner-b. Explain why you can no longer describe the success as part of learner-a’s sequence without additional evidence. Then use the incident-response tabletop to practise assigning decisions and owners.
Continue learning
For guided networking, Linux, security labs and SOC practice, see Cyber Security Training in Vizag. Softenant offers the 3-month course for Rs. 15,000, with classroom and online batch options.