Securing DevOps

8 Analyzing logs for fraud and attacks

This chapter covers

• Examining the components of a logging pipeline’s analysis layer
• Detecting fraud and attacks using string signatures, statistics, and historical data
• Managing techniques for alerting users without overwhelming them

In chapter 7, you learned how to build a logging pipeline to collect, stream, analyze, store, and access logs across the infrastructure. A multilayered pipeline creates a flexible infrastructure where logs from different origins are used to monitor the activity of the organization’s services. Chapter 7 gave an overview of the functionalities provided by each layer of the pipeline. In this chapter, we’ll focus on the third layer, the analysis layer, and dive into techniques ...