Skip to main content
AD Academy
Back to all events
1102SecuritySecurity & attacksCRITLast updated:

Security log was cleared

What it means

Someone cleared the security log. In a healthy environment this is almost never legitimate.

When it is normal and when it is suspicious

Normal only for a planned, documented action. Otherwise a classic track-covering signal.

First steps

  1. 1Alert immediately — classic anti-forensics.
  2. 2Pull logs from the SIEM/forwarder, not from the machine.
  3. 3Review the 30 minutes before the clear.

Fields worth checking

FieldWhat to look at
SubjectWho cleared the log — verify with the infrastructure team immediately.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.