Chapter 11 — Sign-in logs and alerting

Chapter 11 — Sign-in logs and alerting

Lesson map

Lesson 11 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Reading logs"]
  N2["11.2 Configuring alerts"]
  N3["11.3 Responding"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Reading logs"]
  N2["11.2 Configuring alerts"]
  N3["11.3 Responding"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX041"]

[Learning outcomes]
    |
    v
[11.1 Reading logs]
    |
    v
[11.2 Configuring alerts]
    |
    v
[11.3 Responding]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) read sign-in logs; (2) configure useful alerts; (3) respond to alerts proportionately.

11.1 Reading logs

The directory records each sign-in with time, user, application, location, device and result. Tomas learns to filter for failures, sign-ins from new countries and use of the emergency admin account. He reads a week of logs and notices most failures come from one reception tablet repeatedly trying an old password, which he fixes by updating the saved credential. Reading logs regularly builds a picture of normal activity, so unusual events stand out quickly. He records what normal looks like in a short note so others can compare.

11.2 Configuring alerts

Tomas configures a few alerts: any use of the emergency admin account; admin sign-ins outside working hours; sign-ins from outside the country; and more than ten failures for one account in an hour. Alerts go to both IT staff by email. He keeps the list short so each alert is read and acted on. Too many alerts lead to all of them being ignored, which is worse than having a few that are always checked. Tomas tests each alert once with a planned event to prove it arrives.

11.3 Responding

When an alert fires for sign-in failures on a nurse's account, Tomas checks the log: all came from her own phone after she changed her password. He confirms with her and closes the alert, recording the cause. When an out-of-country sign-in attempt is blocked for a dentist, he confirms the dentist is at home, resets nothing, and checks MFA blocked it. Response is proportionate: confirm first, act on evidence, and record the outcome. Each closed alert is listed in the monthly report with its cause.

Worked example

A tablet with a saved old password caused most failures; four alerts are configured, and two alerts in the first month are explained and recorded.

Synthetic case. Logs and alerts are synthetic.

Errors and limits

Creating dozens of alerts leads staff to ignore them all.

Exercises

• EX041 — Failure source. What caused most failures? Rubric: 3 = reception tablet with an old password;; 2 = tablet;; 1 = attacker;; 0 = none.
• EX042 — Alert list. Name one configured alert. Rubric: 3 = emergency admin account use;; 2 = out of hours admin;; 1 = vague;; 0 = none.
• EX043 — Alert volume. Why keep alerts few? Rubric: 3 = so each is read and acted on;; 2 = attention;; 1 = cost;; 0 = none.
• EX044 — Response order. What comes first in response? Rubric: 3 = confirm with the person and evidence;; 2 = confirm;; 1 = reset;; 0 = none.

Synthesis

Regular log reading and a short list of meaningful alerts support proportionate response.

Continue studying — chapter 11 of 18

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →