NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cybersecurity
Log Sources Across the Stack
Understand the critical telemetry required for a SIEM. Explore log sources across the network, endpoint, identity, cloud, and application stack to ensure complete visibility.
Room tasks
1Windows Log Sources Recap
2Linux Log Sources Recap
3Network Log Sources
4Cloud Log Sources Overview
Frequently Asked Questions
What log sources should a SIEM collect?
Key sources include firewalls, DNS, proxies, endpoint logs, identity providers, cloud audit logs, and application logs. Together they give visibility across attacker activity.
Why do log coverage gaps matter?
If a system is not logged, attacks on it go unseen and investigations stall. Mapping sources to threats shows where coverage is missing.
Which logs help investigate account compromise?
Authentication and identity logs, VPN, email, and cloud audit trails show who logged in from where. This free Codelivly room covers how to use these sources.