What are common logging sources in a blue team environment and why are they important?

• A. Firewalls, endpoint protection (EDR), web proxies, VPNs, authentication servers.
• B. Mobile game apps, social media feeds, video streaming services.
• C. Printer status logs, coffee machine telemetry.
• D. Customer support tickets only.

Answer: (A)

Logging sources in a blue-team context provide visibility into what’s happening across network, endpoints, and access controls, which is essential for detecting threats, investigating incidents, and maintaining security posture. The most practical set includes firewalls, endpoint protection (EDR), web proxies, VPNs, and authentication servers. Firewalls log network traffic rules and block events, giving you insight into allowed and blocked connections. EDR tools capture endpoint activity such as process creation, file changes, and behavioral anomalies, helping you spot malware and credential abuse at the source. Web proxies record web requests, destinations, and data transfer patterns, aiding detection of risky sites, data exfiltration, and policy violations. VPNs log remote access activity, session details, and authentication outcomes, which is important for spotting unusual remote access patterns or credential exploitation. Authentication servers centralize login attempts, successes, failures, and account changes, making it possible to detect brute-force attempts, stolen credentials, or privilege escalations. Together, these sources offer comprehensive visibility from network edges through endpoints to identity, enabling timely alerts, quick triage, and effective incident response.

Other options miss the mark because they focus on consumer or non-security telemetry (like mobile apps, social feeds, or video streams) or on non-security data (printer status or coffee-machine telemetry) or only on support tickets, none of which provide the enterprise security visibility needed for proactive defense.