Security teams cannot investigate what their systems never record. For important SaaS platforms, logging should support practical questions about who accessed the service, what changed, and what business-relevant actions occurred.
1. Authentication events
Retain useful sign-in, failed sign-in, session, token, and strong-authentication events where the service makes them available.
2. Privilege changes
Record role assignments, administrator grants, permission changes, and changes to security controls.
3. Configuration changes
Capture changes that affect integrations, sharing, retention, authentication, logging, or other security-relevant behavior.
4. Integration and credential activity
Track creation or use of API credentials, service identities, application authorizations, and material integration changes where supported.
5. Business-relevant data actions
For higher-value systems, understand whether logs can show sensitive exports, bulk changes, deletion, or creation of important business records.
Make logs usable
Define retention, access, alerting, time synchronization, and investigation ownership. Avoid collecting unnecessary sensitive content merely because the platform can log it.
Related knowledge
Continue with Logging and Monitoring Automated Workflows, Secrets and Credential Management, and Incident Response.
References
This is general security guidance. Logging requirements may also be shaped by privacy, legal, regulatory, contractual, and retention obligations.