Logging, IT Atlas

Overview

Useful logging is structured, timestamped in UTC with a consistent source identity, shipped off host promptly, and retained according to a policy that reflects investigative need rather than default settings.

Retention is a security decision. Adversary dwell time frequently exceeds default log retention, which turns an investigation into speculation.

Security considerations

Protect log integrity: append only or write once storage for security relevant logs, with alerting when a source goes silent.
Normalise time zones and clock sync so correlation across sources is valid.

Related topics

SIEM

Security Information and Event Management centralises telemetry from across the estate, correlates it into detections, and supports investigation and reporting.

Monitoring

Collecting and evaluating signals about availability, performance and capacity so problems are detected before users report them.

Observability

The ability to answer new questions about a system's behaviour from its telemetry, without shipping new instrumentation.

NTP

Network Time Protocol synchronises clocks across an estate, which is a prerequisite for authentication, logging and forensics.

Compliance

Demonstrating that controls required by law, regulation, contract or standard are designed and operating effectively.

Security Monitoring

Continuous collection and evaluation of telemetry to detect malicious or anomalous activity across every layer.

Security Monitoring Architecture

A design for collecting, normalising, retaining and analysing security telemetry across identity, endpoint, network, cloud and application layers.