What it is: Reading raw system and security logs to reconstruct what actually happened on a host or in an application — the foundation skill underneath almost every other detection and investigation activity.

Windows Event IDs you must know cold:

4624 — Successful logon. Pay attention to Logon Type (2=interactive, 3=network, 10=RDP) — Type 3 spikes at odd hours often indicate lateral movement.
4625 — Failed logon. A burst of these against one account = brute force; a burst against many accounts from one source = password spraying.
4688 — Process creation. With command-line auditing enabled (Group Policy), this captures the FULL command line — critical for spotting encoded PowerShell or suspicious flags.
4698 — Scheduled task created. A common persistence mechanism; unexpected new tasks deserve scrutiny.
4720 — User account created. Unexpected new accounts, especially with admin group membership shortly after, is a classic post-compromise move.

Sysmon (goes deeper than native Windows logging):

Event ID 1 — Process create, includes full command line AND parent process — lets you spot process masquerading (e.g., svchost.exe spawned from an unusual parent).
Event ID 3 — Network connection, tells you exactly which process opened which connection to where.
Event ID 7 — Image/DLL load — useful for DLL side-loading and injection detection.
Event ID 10 — Process accessed another process's memory — the signature of credential dumping tools accessing LSASS.

Exam trap: Questions often test whether you know native Windows Event Log auditing must be explicitly configured (command-line auditing isn't on by default) — don't assume 4688 always shows command-line arguments unless the scenario says auditing was enabled.