Log Management

Critical Sources (must log — no exceptions):
  └─ Authentication: Windows Event 4624/4625, SSH auth.log, VPN auth
  └─ Network: Firewall accepts/denies, NetFlow, proxy logs
  └─ System: Process creation (Sysmon/EDR), scheduled tasks, service installs
  └─ Cloud: CloudTrail (AWS), Activity Log (Azure), Audit Log (GCP)
  └─ Email: DMARC/DKIM reports, phishing filter logs
  └─ DNS: All queries and responses
  └─ Database: Access logs, query audit logs
  └─ Application: Web server access logs, API gateway logs

High-Value Sources (strongly recommended):
  └─ DHCP: IP-to-MAC mapping (forensic trail)
  └─ VPN: Connection logs, source IP
  └─ TLS: Certificate transparency logs
  └─ Vulnerability scanner: Scan results
  └─ Patch management: Patch status

Nice-to-Have:
  └─ Physical access: Badge in/out logs
  └─ HVAC/OT logs (if applicable)
  └─ Printer logs
  └─ Voicemail logs

Minimum Fields (RFC 5424 syslog):
  └─ Timestamp (with timezone, ISO 8601 format)
  └─ Source IP
  └─ Destination IP
  └─ User identity (if applicable)
  └─ Action/event type
  └─ Result (success/failure)
  └─ Unique event ID
  └─ Hostname / system identifier

Example well-formed log (JSON):
{
  "timestamp": "2026-06-15T14:30:00.123Z",
  "event_id": "4625",
  "source_ip": "203.0.113.42",
  "hostname": "DC-01.corp.company.com",
  "user": "administrator",
  "action": "failed_logon",
  "result": "failure",
  "failure_reason": "unknown_user_or_bad_password",
  "logon_type": 3,
  "process_id": 456,
  "session_id": "0x123abc"
}

Retention by Regulation:
  └─ PCI DSS: 12 months (3 months immediately available)
  └─ HIPAA: 6 years
  └─ GDPR: As long as needed for purpose (guidance: 12 months for security)
  └─ SOX: 7 years
  └─ NIST CSF: Based on risk assessment (guidance: 12 months minimum)
  └─ ISO 27001: Based on retention schedule (guidance: 12 months)

Tiered Retention Strategy:
  └─ Hot Tier (immediate search): 30-90 days
     └─ Fast storage (SSD/NVMe)
     └─ Full indexing
     └─ Budget: ~$1-3/GB/month
  └─ Warm Tier (searchable, slower): 6-12 months
     └─ Standard storage (HDD)
     └─ Reduced indexing
     └─ Budget: ~$0.50-1/GB/month
  └─ Cold Tier (archive): 1-7+ years
     └─ Object storage (S3 Glacier, Azure Archive)
     └─ No indexing (must restore for search)
     └─ Budget: ~$0.01/GB/month

Daily Log Volume Estimates:
  └─ Per Windows workstation: 50-200 MB/day (verbose auditing)
  └─ Per Windows server: 100-500 MB/day
  └─ Per Linux server: 10-50 MB/day
  └─ Per firewall: 500 MB - 5 GB/day
  └─ Per web server: 1-10 GB/day
  └─ Per EDR agent: 100-500 MB/day (telemetry)
  └─ AWS CloudTrail (per region): 1-5 GB/day
  └─ Azure AD: 500 MB - 2 GB/day
  └─ DNS server: 1-5 GB/day

Sample Calculation — 500-user organisation:
  └─ 500 workstations: 50 MB × 500 = 25 GB/day
  └─ 50 servers: 200 MB × 50 = 10 GB/day
  └─ 2 firewalls: 2 GB × 2 = 4 GB/day
  └─ CloudTrail (3 regions): 2 GB × 3 = 6 GB/day
  └─ EDR: 200 MB × 550 = 110 GB/day
  └─ Total: ~155 GB/day → 4.6 TB/month → 55 TB/year

Log Integrity Controls:

  Forward Immediately:
    └─ Logs sent to central SIEM as generated
    └─ Local logs are copies, not primary
    └─ Network capture: switch port mirroring (cannot be disabled by attacker)

  Write-Once Storage:
    └─ Append-only storage (immutable)
    └─ AWS S3 Object Lock with retention mode
    └─ WORM (Write Once Read Many) storage

  Hashing / Signing:
    └─ Chain hashing (each log entry includes hash of previous)
    └─ RFC 5702: syslog-sign extension
    └─ Block-chain based verification (for high-security environments)

  Access Control:
    └─ Separate admin for SIEM (different credentials from AD)
    └─ MFA for log management access
    └─ Audit log for who accesses logs
    └─ Alert when logs are modified or deleted

  Monitoring:
    └─ Alert on log source going silent (attacker disabled logging)
    └─ Alert on log volume anomalies
    └─ Monitor SIEM health dashboard