CSA (312-39) SOC Simulation Lab

Master log source configuration for threat intelligence. In this scenario, you must determine the optimal standardized web log format to ensure your SIEM parses the telemetry necessary to detect automated attacks.

Scenario Context

You are the Tier 3 Analyst on shift at Web4Everyone, a massive managed hosting provider. Your L1 analyst comes to you frustrated. They are trying to build a Splunk query to track a distributed credential stuffing attack targeting customer WordPress logins.


The SIEM engineering team needs to standardize the log ingestion format across all 5,000 load balancers. The L1 analyst knows they need the remote host (IP), timestamp, and status code, but specifically notes they need the user-agent to fingerprint the attacker's automated tool (e.g., Python-Requests or THC Hydra) vs. legitimate customer browsers.

Security Environment

You pull up a side-by-side comparison of the SIEM parsing results from two different web servers configured with different logging standards:

--- SIEM PARSER DIAGNOSTIC: HTTP EVENT INGESTION --- [REQUIREMENT]: Extract Client IP, Date, URI, Status, AND User-Agent
--- SERVER A (Legacy Configuration) --- RAW: 203.0.113.45 - admin [08/Apr/2026:17:30:00 +0000] "POST /wp-login.php HTTP/1.1" 401 512 RESULT: PARSING INCOMPLETE. Field 'http_user_agent' not found in event.
--- SERVER B (Modern Configuration) --- RAW: 203.0.113.45 - admin [08/Apr/2026:17:30:05 +0000] "POST /wp-login.php HTTP/1.1" 401 512 "-" "Hydra v9.5 (https://github.com/vanhauser-thc)" RESULT: PARSING SUCCESSFUL. Extracted 'http_user_agent' for threat intel matching.

Question

A large web hosting service provider Web4Everyone is responsible for hosting multiple major websites, social media platforms and more. You are working here as a L1 SOC analyst responsible for investigating web server logs for potential malicious activity. Recently, your team detected multiple failed login attempts and unusual traffic patterns targeting the company's web application. To efficiently analyze the logs and identify key details such as the remote host, username, timestamp, requested resource, and HTTP status code, and user-agent you need a structured log format that ensures quick and accurate parsing. Which standardized log format will you choose for this scenario?

Senior Analyst Hint: "Look closely at the required fields. Common Log Format stops at the 'Bytes Sent' field. Which standardized format *extends* the baseline to include headers like User-Agent and Referer?"

Tier 3 Analyst Insight

1. What is happening?

During a brute-force or credential stuffing investigation, analysts rely heavily on the User-Agent field. Attackers using automated tools (like Hydra, Burp Suite, or custom Python scripts) often forget to spoof their User-Agent string, leaving an easily detectable fingerprint. If the web server isn't configured to log this specific field, the SOC is operating completely blind to attacker toolsets.

2. Why the correct answer is correct (Option B)

Extended Log Format (ELF), originally defined by the W3C, is the correct answer. It is a standardized, customizable format that allows administrators to append additional HTTP headers to the log entry—most notably the Referer and User-Agent. Without ELF, you cannot reliably parse the specific tool the attacker is utilizing.

3. Why the other options are wrong

A is incorrect. The Common Log Format (CLF) is the rigid, legacy standard (often called NCSA format) that only records: Host, Ident, Authuser, Date, Request, Status, Bytes. It completely omits the User-Agent.
C is incorrect. While JSON is a structured data format heavily used in modern SIEM environments, it is not the traditional "standardized web log format" (W3C standard) the question is referencing for IIS/Apache legacy configurations.
D is incorrect. Tab-Separated Values (TSV) is just a delimiter method, not a formalized logging standard that dictates the inclusion of HTTP fields.

4. Real-world SOC application

When onboarding a new application into Splunk or Sentinel, the first thing a SOC engineer does is verify the web server configuration (like LogFormat in Apache or the W3C Logging settings in IIS). If they see "%h %l %u %t \"%r\" %>s %b" (CLF), they reject it and demand "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" (Combined/Extended) before building detection logic.

⚡ MINI LESSON: User-Agent Threat Hunting

User-Agents are incredibly noisy, but hunting for anomalies within them is a highly effective SOC technique. Look for User-Agents that state they are browsers but lack version numbers (e.g., Mozilla/5.0 with nothing else), or tools that shouldn't be communicating directly with your login page (e.g., curl/7.68.0, python-requests/2.25.1, or Go-http-client/1.1). Grouping failed logins by these anomalous agents allows you to instantly block the attacker's infrastructure via WAF.

Refine your Threat Hunting Skills

Practice identifying data sources and building detection logic in our advanced labs.

Explore more CSA simulations