# Security from Zero — Topic 04 workbook

Goal: read a log record, reconcile a repeated row, build a UTC timeline and explain what needs checking next.
Lesson: https://secopsnomad.si/blog/security-from-zero-04-security-logs/
Dataset: https://secopsnomad.si/downloads/security-from-zero-topic-04-auth.jsonl

This is a fictional, normalised teaching dataset. It is not a raw Windows export or a real incident. No SIEM or Windows access is needed for the core exercise.

## Scope and source

Date of analysis:
Question you are investigating:
Original file name and where you saved it:
Provider / channel:
Computers:
Earliest / latest event time and time zone:
What evidence is absent from this file?

## Read one record

Computer / channel / record ID:
Event ID and documented meaning:
Target account (not the Subject account):
Logon type and meaning:
Source IP (or not supplied):
Status / substatus, if present:
What is the difference between an event ID and a record ID?
What does JSON's doubled backslash represent?

## Reconcile and order

Input row count:
Exact duplicate: computer / channel / record ID:
How did you confirm that the entire record matches?
Why must the same record number on another computer be retained?
Distinct-event count:
Failure count / success count:

Keep the original file unchanged. Use UTC and a separate working timeline.

| Time (UTC, with date) | Computer / record ID | Event ID | Target account | Logon type | Source IP | Observation |
| --- | --- | --- | --- | --- | --- | --- |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |

## Focused sequence

Filter: LAB-PC1 / LAB\mira / 192.0.2.44 / logon type 3.
Relevant record references, in time order:
First / last time and elapsed seconds:
Failure count / success count:
Why is the later type-2 event separate?
Why do the two LAB-PC2 accounts remain distinct?

Two possible explanations:
1.
2.

Evidence that could help distinguish them:
Why does a successful logon fail to settle whether access was authorised?
What cannot an IP address alone tell you?

## Optional Windows observation

Executed / not executed:
Windows version / shell:
Access outcome (records / no match / access denied / other):
Exact start/end times and display time zone:
Event Viewer General vs XML: which fields did you compare?
PowerShell record cap and sort order:
Why is a capped result not a complete count?

Keep any real host/account names and exported logs private. Do not change audit policy or generate failures for this exercise.

## One-page triage note

Question and scope:
Source and evidence references:
Observed sequence:
Interpretation and alternative explanations:
Unknowns, missing fields and unexecuted steps:
Next checks, their initial time window, and what each would resolve:
Current disposition and why:

## Interview practice

Explain: 4624 vs 4625; record ID vs event ID; UTC vs local display; type 3 vs type 10; exact duplicates vs separate events; an event vs an alert.

## Before sharing

- [ ] I labelled this as a fictional training exercise.
- [ ] I preserved the source file and explained the repeated row.
- [ ] My table, counts and focused sequence agree.
- [ ] I separated observations, hypotheses and unknowns.
- [ ] I did not claim a confirmed compromise or a universal severity.
- [ ] I can explain what each follow-up check would establish.
- [ ] My project description claims only work I actually performed.