liveBook · Manning

Web server access log

As explained in Cyber Threat Hunting

A web server log is a chronological record of requests, errors, and other activity handled by a web server.

A web server access log is a chronological record of requests handled by a web server. During threat hunting, it provides evidence of suspicious web activity and helps investigators reconstruct an attack timeline. Its value depends on what the server records, how long events are retained, and whether events are copied to a central store. section 4.0 section 4.2.2

Use access logs as part of a repeatable investigation:

  • Correlate suspicious web requests with threat-intelligence findings and other available data sources. section 4.0
  • Compare request activity with files, temporary directories, error logs, firewall events, system logs, or API audit logs. section 4.2.2 section 5.3.1
  • Preserve and review centrally collected events when attackers may have modified or deleted local log files. section 4.2.2
  • Document findings in a timeline, communicate evidence to response teams, and evaluate escalation according to incident severity. section 4.2.2 section 4.0

Investigating suspicious Apache activity

An investigation finds suspicious web requests on June 16. The Apache2 directory contains access.log, error.log, and other_vhosts_access.log created that day, while earlier local log versions are missing. Central event collection preserves the earlier events, revealing possible log tampering and root-level access. The finding changes the response from disabling one account to treating the host as compromised and considering escalation. section 4.2.2

Listing 4.12 Content of the Apache2 default log directory
-rw-r--r-- 1 root root   1032809 Jun  17 20:38 access.log
-rw-r--r-- 1 root root    133666 Jun  17 21:49 error.log
drwx------ 2 root root     16384 Dec 22 18:53 lost+found
-rw-r--r-- 1 root root    358598 Jun  17 21:38 other_vhosts_access.log

Inspect the Apache2 log directory listing to see the access, error, and virtual-host log artifacts used during investigation. section 4.2.2

How Cyber Threat Hunting covers it

How deep it goes
Treats access logs operationally through source selection, correlation, retention limits, timeline updates, and log-tampering analysis.
Examples
Uses Apache2 access.log, error.log, other_vhosts_access.log, suspicious requests, deleted files, and a findings timeline.
What it assumes
Assumes access to a searchable event store and supporting infrastructure data while teaching source limitations and investigation communication.
What you can do after
Diagnose/debug with it by correlating requests, preserved events, filesystem evidence, and infrastructure logs to identify compromise and guide escalation.
How it connects
Connects web server access logs with threat intelligence, threat hunting, vulnerability management, incident response, system logs, and cloud firewall logs.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.