Which network logs actually help in an investigation?
Mar 3rd, 2023 by Jesper Kråkhede
I have been asked many times which network logs are worth putting into a SIEM. After many incidents, here is my short list, together with what Microsoft recommends for Sentinel.
The useful ones. Logs from the internet edge, especially outbound connections and what was denied. They show command and control traffic and data leaving. DNS query logs, because almost every attack needs name resolution and the domains tell a story. Logs from the VPN and other remote access, because that is where many attackers come in. Proxy or web gateway logs, if you have one. And flow logs from your cloud networks, where you often have no other view.
The less useful ones. Full internal east-west flow logs from every switch. They are huge, rarely queried, and in my experience the endpoint and identity logs tell the same story in a fraction of the volume.
Microsoft´s data collection best practices for Sentinel point in the same direction. Prioritise your data connectors. Filter logs before ingestion, so irrelevant events and fields never reach the expensive storage. Use the cheaper Basic logs tier for high volume, verbose data that you need to search during investigations but don´t run detections on. And normalise network data with ASIM, so the same queries work regardless of firewall vendor.
The best network log is the one you can afford to keep long enough to be useful.