SOC Sample Logs 🛡️ A collection of realistic sample log files simulating a full SOC incident lifecycle — from a quiet morning through active attack, breach, lateral movement, and data exfiltration. Built to support Python SOC scripting practice and log analyser tool development.
Incident Timeline These logs tell one coherent story across all five sources. Every file covers the same three phases: PhaseTimeframeWhat happensQuiet06:00 – 08:00Normal user activity — clean baseline trafficAttack08:00 – 10:00Reconnaissance, brute force, web scanningBreach10:00 – 12:00Lateral movement, persistence, C2 beaconing, exfiltration
Log Files 🔥 firewall.log Simulated perimeter firewall log — 500 lines What to look for:
Repeated BLOCK entries from the same source IP — brute force pattern Connections to suspicious ports: 4444 (Metasploit), 3389 (RDP), 445 (SMB), 22 (SSH) Internal hosts connecting outbound to known bad IPs — possible C2 Lateral movement: internal IP → internal IP on ports 445, 3389, 135
Format: YYYY-MM-DD HH:MM:SS ACTION PROTO src=IP dst=IP port=PORT user=USERNAME failed=COUNT
🪟 windows_event.csv Simulated Windows Security Event Log export — 500 lines Key Event IDs to investigate: EventIDMeaningWhy it matters4625Failed logonBrute force indicator4740Account lockoutThreshold exceeded4624Successful logonCheck after failed attempts4672Special privileges assignedPrivilege escalation4720User account createdAttacker persistence4728Added to admin groupPrivilege escalation7045Service installedMalware persistence4698Scheduled task createdMalware persistence4688Process createdLook for suspicious commands What to look for:
Clusters of 4625 from same IP followed by a 4624 — successful brute force 4720 + 4728 together — attacker created and elevated a backdoor account 4688 with commands like mimikatz, powershell -enc, net user /domain 7045 or 4698 from an external IP — remote persistence mechanism
🌐 web_access.log Simulated Nginx web server access log — 500 lines What to look for:
Known scanner user agents: sqlmap, Nikto, masscan, WPScan Path traversal attempts: ../../etc/passwd SQL injection in URLs: ?id=1' OR '1'='1 XSS attempts: <script>alert(1)</script> Repeated 401/403 responses from same IP — brute force or scanning POST requests to /admin/upload — potential webshell upload
Format: IP - USERNAME [TIMESTAMP] "METHOD PATH HTTP/VERSION" STATUS SIZE "REFERRER" "USER-AGENT"
🔍 dns.log Simulated DNS query log — 500 lines What to look for:
Same internal host querying the same suspicious domain every 25–35 seconds — C2 beaconing TXT record queries with long random subdomains — DNS tunnelling Queries resolving to known bad IPs Domains ending in .xyz, .ru, .cc with random-looking names High volume of NXDOMAIN responses — possible DGA (Domain Generation Algorithm)
Format: YYYY-MM-DD HH:MM:SS CLIENT_IP RECORD_TYPE DOMAIN RESOLVED_IP STATUS
🚨 ids_alerts.log Simulated Snort IDS alert log — 500 lines Priority levels: PriorityMeaningExamples1Critical — immediate actionC2 traffic, EternalBlue, Cobalt Strike, exfiltration2High — investigate soonBrute force, DNS tunnelling, lateral movement3Medium — reviewPort scans, recon tools Key alerts to focus on:
MALWARE-CNC and Cobalt Strike Beacon — active C2 channel LATERAL-MOVEMENT Pass-the-Hash — attacker moving through the network EXFIL alerts — data leaving the network EXPLOIT EternalBlue / Log4Shell — known critical CVEs being exploited
Format: [] [RULE-ID] RULE-NAME [] [Classification: TYPE] [Priority: N] TIMESTAMP SRC:PORT -> DST:PORT PROTO
Attacker IPs in These Logs IPRole185.220.101.45Primary attacker — brute force and C245.33.32.156Web scanner and RDP attacker198.20.69.74SSH brute force64.62.197.152Web application attacker91.108.4.1C2 server89.248.167.131SQL injection and XSS194.165.16.72Port scanner
Compromised Internal Hosts HostWhat happened10.0.0.15C2 beacon — querying malicious domain every 30 seconds10.0.0.22DNS tunnelling — data exfiltration via DNS TXT recordsSERVER-DC-01Backdoor account created, added to Domain Admins
How to Use These Files These logs are designed to be parsed with Python. Suggested exercises:
Extract all unique attacker IPs from firewall.log and count their blocked connections Find the brute force pattern in windows_event.csv — identify which account was eventually compromised Detect the C2 beacon in dns.log — find the domain queried at regular intervals Calculate severity scores from ids_alerts.log — count Priority 1 alerts per source IP Correlate across files — find the IP that appears as malicious in all 5 logs
About These logs were generated as part of a Python SOC scripting learning project. Part of the soc-python-tools repository collection. Author: Sreejith Reji Background: MSc Cyber Security | CEH | CompTIA Security+ Role: SOC Analyst (L1)