8 Analyzing logs for fraud and attacks
This chapter covers
- Examining the components of a logging pipeline’s analysis layer
- Detecting fraud and attacks using string signatures, statistics, and historical data
- Managing techniques for alerting users without overwhelming them
In chapter 7, you learned how to build a logging pipeline to collect, stream, analyze, store, and access logs across the infrastructure. A multilayered pipeline creates a flexible infrastructure where logs from different origins are used to monitor the activity of the organization’s services. Chapter 7 gave an overview of the functionalities provided by each layer of the pipeline. In this chapter, we’ll focus on the third layer, the analysis layer, and dive into techniques and code samples to detect fraud and attacks on services.