CompTIA Exam Prep - ITF+, A+, Network+, Security+, CySA+

Syslog assigns every message a severity level from 0 to 7. The numbering is the part people get wrong, and it is the part exams test. Lower numbers are more severe. 0 is an emergency; 7 is debug chatter. It runs backwards from how most people expect a severity scale to work. The Eight Levels Level Keyword Meaning 0 Emergency The system is unusable. Total failure. 1 Alert Action must be taken immediately. A critical subsystem has failed. 2 Critical Critical conditions — a hardware fault, a failing disk. 3 Error Error conditions. Something failed but the system continues. 4 Warning Something may become a problem — a threshold approaching, a deprecated call. 5 Notice Normal but significant. A configuration change, a service restart. 6 Informational Routine operational messages. 7 Debug Verbose diagnostic detail, for troubleshooting only. Remembering the Order The classic mnemonic reads down the list from 0 to 7: E very A wesome C isco E ngineer W ill N eed I ce C ream...

A SIEM — Security Information and Event Management — collects log and event data from across an environment, normalizes it into a common format, correlates events from different sources, and raises alerts when the combination looks like an attack. It is the central nervous system of most security operations centres. The value of a SIEM is not in any single log. It is in seeing a failed login on the VPN, a successful login from another country, and a privilege escalation on a server as one event rather than three. The name is a merger of two older categories: SIM (security information management — log storage, retention and reporting) and SEM (security event management — real-time monitoring and correlation). A SIEM does both, and exams occasionally test the expansion. What It Actually Does Collection. Ingests from firewalls, IDS/IPS, endpoints and EDR , servers, applications, identity providers, cloud platforms, and network devices — via agents, syslog, or API. Normaliza...