Sometimes, you’ve to quickly investigate a webserver logs for potential malicious activity. If you’re lucky, logs are already indexed in real-time in a log management solution and you can automatically launch some hunting queries. If that’s not the case, you can download all logs on a local system or a cloud instance and index them manually. But it’s not always the easiest/fastest way due to the amount of data to process.
Article Link: https://isc.sans.edu/diary/rss/30792