>> Welcome back to the course,
but now it's time to say, we're done.
After the last video,
where we talked about other sources of logs like IPS,
IDS, and web application firewall,
>> in this video, we'll do a course summary.
>> This was a basic course.
The main objective of this course was to introduce
you to log analysis and since today,
web applications are present in our lives,
this is a good way to start doing log analysis.
This course was built based off of the routines
of offenders and also SOC analysts.
Let's do a brief review of the course topics.
We had two modules in our course.
The first was an introduction and review.
We started with a course introduction,
followed by a web application review,
where we talked about web application components
like the web server and clients.
After, we talked about a really important component,
the web server, we talked about Apache, NGINX and IIS.
Also, in this lesson,
we talked about web server logs.
To conclude module 1,
we gave some advice on how to perform a good analysis,
and we also touched on
some log analysis mistakes or errors.
Module 2 was the module for log analysis.
The first topic of Module 2 was
>> web application attacks.
>> We discussed vulnerability attacks and
the OWASP Top 10 project.
In this course, we use
the 2017 version of the OWASP Top 10 project.
An important thing here is,
even if the OWASP Top 10 launched a new version,
the information about these attacks won't change.
Some vulnerabilities and attacks have become less
popular and maybe the new type
of attacks can be found more.
But that's why it's important to
understand web server logs.
After this introduction, we
started talking about the attacks.
Vulnerability scans, Brute Force attacks,
>> SQL injection,
>> file inclusion, cross-site scripting
and cross-site request forgery.
For each of these attacks, we gave
some directions on how to identify them.
For example, the user agent can help a lot,
but don't forget that HTTP requests can be crafted.
Remember to understand what the log means,
what the log wants to say to you.
Remember the questions who, what, and when.
Look for key components of the log,
like the IP address and don't
worry if you don't understand all the log fields.
Log analysis skills improve with practice.
The more log analysis you do, the better you'll be.
After all of these attacks and log analysis,
we talked about TCP and HTTP flood,
and we discussed how to identify them.
To finish the course, we talked about
two really important tools that help SOC analysts,
IPS/ IDS, and WAF.
To conclude, some final words.
Many helped the course architect
Igor Vieira during this course.
But he would like to mention
three teaching assistants that
helped him with this class.
Thank you, he really appreciate the help.
A final thanks to all the Cybrary staff,
and now, thank you for watching this course.
Igor Vieira really enjoyed
the time spent creating this course.
We hope you really enjoyed this course,
and we hope it improved your knowledge
and motivated you to continue learning.
To continue learning, please
check out the Cybrary catalog.
There are many great courses.
If you have any questions or doubts,
please contact the course architect, Igor Vieira.
Thank you, and we'll see you in the next course.