An analyst must find every failed login across several gigabytes of authentication logs collected from dozens of servers and then count the failures per source IP address. Which approach is most effective?
Select an answer to reveal the explanation.
Short Explanation
You don't read a phone book cover to cover to find everyone named Smith; you search for the name and count the hits. Log parsing works the same way: match the failure event, pull out the source address, and tally it. The trap is the manual review, which sounds thorough but won't scale to gigabytes.
Full Explanation
Log parsing turns large volumes of semi-structured text into answers. The analyst identifies the pattern that marks a failed authentication, such as a specific event identifier or message string, filters every log for that pattern using regular expressions or the query language of a SIEM, extracts the source address field, and groups and counts the results. The same technique scales from one file to thousands and produces a repeatable query that can be saved, reviewed, and turned into an alert. Opening each file in a text editor is accurate in principle but impractical at gigabyte scale; it is slow, error-prone, and produces no consistent count. A credentialed vulnerability scan checks configuration and missing patches; it does not report historical logon failures from existing logs. Starting packet captures only records traffic from now on, cannot see past attempts, and encrypted authentication traffic would hide the outcome of each attempt anyway, while the logs already contain the needed records. Exam caveat: parsing depends on consistent formats and synchronized time, so normalizing fields and confirming time sources before counting avoids misleading results. Operational check: run the filter against one server first, compare a few hits by hand to confirm the pattern matches only failures, then apply it to the full set and sort by count.