0Pricing
Cyber Security Academy · Lesson

Using Logs and Telemetry

Hunt across data sources.

Using Logs and Telemetry is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Data Powers Hunting

A hunt is only as good as the data behind it. Logs and telemetry are the evidence trail attackers leave across systems.

This lesson covers the key data sources and how to hunt across them.

Endpoint Telemetry

Endpoint data is the richest source. Tools like EDR and Sysmon record process creation, command lines, file writes, and registry changes.

Most modern attacks touch an endpoint, so this is where many hunts begin.

Endpoint signals:
  - process creation + command line
  - parent/child process tree
  - file and registry modifications
  - module/DLL loads

Network Logs

Network data shows where hosts connect. Firewall logs, proxy logs, DNS logs, and Zeek records reveal beaconing, exfiltration, and lateral movement.

These complement endpoint data by showing the communication side.

Authentication Logs

Authentication logs expose how accounts are used. Look for logins at odd hours, from new locations, or failed-then-successful patterns.

Windows event IDs and directory logs are central here.

Auth red flags:
  - 4625 (failed) then 4624 (success)
  - logon from new geo / new host
  - service account interactive logon

Cloud and SaaS Logs

Modern environments generate cloud logs: API activity, identity sign-ins, and configuration changes.

Hunt for new access keys, disabled logging, or unusual administrative API calls.

Centralize with a SIEM

A SIEM collects logs from everywhere into one searchable place. Hunting across sources is only practical when the data is centralized.

Splunk, Elastic, and Sentinel are common platforms.

Normalization Matters

Different sources name fields differently. Normalization maps them to a common schema so one query can span many sources.

Without it, you write a new query for every log format.

src_ip, source.ip, ClientIP
  -> normalize to: source_address

Correlating Across Sources

The real power is correlation: tie an endpoint process to a network connection to an authentication event for the same host and time.

One source raises suspicion; three sources together build a case.

host=WS-04 at 02:14:
  endpoint: powershell spawned by word
  network:  outbound to 185.x.x.x:443
  auth:     admin login from WS-04
= strong lead

Mind the Gaps

Know what you are not logging. Attackers thrive in blind spots: unlogged hosts, disabled command-line auditing, or short log retention.

Identifying gaps is itself a valuable hunt outcome.

Retention and Volume

Logs are huge and storage is finite. Balance retention against cost so that when you hunt, the data still exists.

An attack discovered today may have started months ago; short retention hides it.

Turn Findings Into Detections

When a hunt across logs finds a technique, encode it as a detection rule so the SIEM catches it automatically next time.

This is how manual hunting continuously strengthens automated defense.

Quick Check

Test your understanding of logs and telemetry.

Recap

You learned to hunt across logs and telemetry.

  • Endpoint data (process, command line) is the richest source.
  • Network, authentication, and cloud logs add context.
  • A SIEM centralizes data; normalization enables cross-source queries.
  • Correlate sources to build strong leads.
  • Mind logging gaps and retention; convert findings into detections.

Next you will map your findings to MITRE ATT&CK.

Frequently asked questions

Is the “Using Logs and Telemetry” lesson free?

Yes — the full text of “Using Logs and Telemetry” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Using Logs and Telemetry”?

Hunt across data sources. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Using Logs and Telemetry” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Threat Hunting Mindset
  2. Hypothesis-Driven Hunting
  3. Using Logs and Telemetry
  4. MITRE ATT&CK Mapping
← Back to Cyber Security Academy