SOC / Blue Team · 5 min
Reading Authentication Logs
Where investigations usually begin
This lesson explains the concept, then checks your understanding in a short interactive exercise.
Common fields
Authentication logs vary by system, but most contain a similar set of fields.
- Timestamp
- Username
- Source IP address
- Result (success/failure)
- Application or system accessed
- Authentication method (password, MFA, token)
- Device identifier
- Approximate location
Location is approximate, not exact
'Location' in a log is usually derived from IP geolocation databases. It can be wrong, outdated, or reflect a VPN or proxy exit point rather than the user's real location. Treat it as a clue, not a fact.
Loading the interactive lesson…