Security logging feels optional until something suspicious happens. Then the questions arrive quickly: Who signed in? Was an administrator created? Did a sharing rule change? Was information exported?
Prioritize identity and privilege
Keep useful records of sign-ins, multifactor events, account recovery, administrator changes, and material permission changes where platforms provide them.
Watch configuration and data actions
Record important security-setting changes, forwarding or sharing changes, integration authorizations, bulk exports, and unusual deletion where appropriate.
Make logs usable
Retention, access control, alerting, and ownership matter. A large collection nobody can search or interpret is not an investigation capability.
Begin with the questions an investigator would ask
Suppose someone reports that a supplier’s bank details were changed. The investigation needs to establish which account signed in, whether multifactor authentication was challenged, what permissions the account held, when the record changed and whether related messages or payment instructions were sent. Collecting every available log without knowing how to answer those questions can waste storage and still leave gaps.
Make a short list of the events that would matter most if a critical account or system were misused. Priorities often include successful and failed sign-ins, password resets, privilege changes, changes to security settings, new integrations, unusual exports and important administrative actions. Collect only what is lawful, necessary and proportionate to the organization’s purpose.
Make events attributable and timely
Useful records identify the action, actor or service identity, affected resource, outcome and time. Where supported, include the relevant source address, session or request identifier, but recognize that shared devices, remote access and automated services can complicate attribution. A timestamp is valuable only when clocks are reasonably synchronized and time zones are understood.
Keep administrative accounts separate from everyday accounts wherever practical. If six employees share the same login, an event may identify the account but not the person who performed the action. Fixing that identity gap can matter more than buying a larger log platform.
Choose a retention period with a reason
Retention needs depend on investigation windows, legal obligations, privacy, storage cost and the sensitivity of the events. A blanket promise that every event must be stored forever creates its own risk. Decide which records need short-term operational access, which may need longer restricted storage, and when they should be deleted.
Protect logs from unauthorized reading, alteration and deletion. Restrict who can export them and avoid capturing passwords, access tokens, entire customer messages or other unnecessary sensitive material. Log collection should support security without turning ordinary employee activity into indiscriminate surveillance.
Test whether the evidence can be found
Run a safe exercise: create and then remove a temporary test account, change a noncritical setting, or perform a permitted sample export. Confirm that the expected record appears, is timestamped consistently, identifies the correct actor and can be retrieved by someone other than the person who set up the logging system.
Document any missing coverage. If a cloud supplier provides only limited audit records, note the limitation and decide whether another control can reduce the resulting risk. More collection is not always possible, so investigation procedures must be honest about the evidence they can and cannot provide.
Turn logging into an operational routine
- Identify the owner of each critical log source and the person who reviews alerts.
- Set alerts for a few actionable events, then tune them against real false positives.
- Check regularly that data is still arriving from the systems that matter.
- Rehearse retrieving records for a sample incident and preserve the retrieval steps.
CISA’s Logging Made Easy program provides an example of making centralized logging approachable for organizations with limited resources. Tool selection should follow the organization’s coverage and privacy requirements, not precede them.