Which logs do you really need?
Jul 19th, 2019 by Jesper Kråkhede
When I ask customers what they log the answer is usually something with the firewall. Gigabytes per day of network flows that cost a fortune to store and that nobody reads.
In a Zero Trust world the interesting stuff happens elsewhere. Start with the identity logs: sign-ins, failed sign-ins, MFA changes, risky sign-ins, changes to privileged groups and consents to applications. Then the security logs from your endpoints and servers: logons, process creation, use of admin tools and the alerts from your EDR. Add the audit logs from your cloud services and from where your most sensitive data lives. That is where you see an attacker, because sooner or later he has to use an identity to do anything at all.
Network logs still have their place but mostly they confirm what you already know. And a lot of the traffic is encrypted anyway.
Then there is the money. Logging is not free and the SIEM bill has a tendency to grow faster than the security budget. So think before you send everything to the most expensive storage. Keep the high value logs hot and searchable, put the bulky ones in cheaper storage where you can reach them during an investigation and throw away what nobody will ever look at. Decide how long to keep the logs based on how long it takes you to find an intruder, not on what the vendor suggests.
Log smart, not everything.