The logs you will wish you had

Every incident investigation eventually hits the same wall. We can see the attacker arrive, and we can see the damage, but the middle is missing. The logs were never switched on, were kept for seven days, or were overwritten by the attacker on their way out.

You do not need a large security operations centre to avoid that. You need the right handful of sources, kept long enough, somewhere an attacker cannot easily erase them.

Start with identity

Most intrusions we handle today begin with an account, not an exploit. That makes your identity provider the single most valuable log you own.

• Sign-in logs, including failures, the device, location and whether MFA was used.
• Audit logs for changes: new MFA methods registered, password resets, role assignments and new application consents.

These two answer the first questions in almost every case: which account, from where, and what did they change so they could come back.

Email and collaboration

Business email compromise lives and dies in the mailbox. Make sure you keep mailbox audit events, especially the creation of inbox rules and forwarding addresses, and the record of which messages were accessed. Without the access records, you cannot tell a regulator whether a mailbox full of customer data was actually read, and you may have to assume the worst.

Cloud control plane

Every major cloud provider records API activity: who created a user, changed a security group, made a storage bucket public or disabled a log. Turn it on for every account and region, including the ones you think are unused. Attackers like unused regions for exactly that reason.

Endpoints

On laptops and servers, the minimum useful set is process creation with command lines, logons, and changes to scheduled tasks and services. An endpoint detection tool gives you this and more. If you do not have one, built-in operating system logging configured properly is far better than nothing.

Edge and remote access

VPN, firewall and remote access gateways see every external connection into your network. Keep their authentication and session logs. When an appliance is compromised, these logs, stored somewhere other than the appliance itself, are often the only record of what came through.

Keep them long enough, and out of reach

Attackers often sit in a network for weeks before anyone notices. A seven-day retention window means you will be investigating with the most important evidence already gone.

1. Keep at least 90 days of searchable logs, and a year of archived logs for identity, email and cloud audit trails.
2. Send logs to a separate account or service where the people who administer production cannot delete them.
3. Alert on the logs going quiet. A source that suddenly stops sending is one of the most reliable signs that someone is covering tracks.

Good logging is unglamorous and rarely gets budget until after an incident. It is also the difference between telling a customer exactly what happened and telling them you will probably never know.