Add AGENTS.md guidance and expand Security policy library

Security/logging_monitoring_guidance.md

@@ -0,0 +1,42 @@
+# Logging, Monitoring & Retention Guidance
+
+**Document owner:** [Owner/Role]  
+**Approved by:** [Steering Committee / CISO]  
+**Effective date:** [YYYY-MM-DD]  
+**Review cadence:** [Annually]
+
+---
+
+## 1. Purpose & Scope
+Implementation guidance for the [Logging, Monitoring & Retention Policy](logging_monitoring_policy.md). Applies to IT, security operations, and system owners.
+
+---
+
+## 2. Log Source Priority Checklist
+Wire these up first — they're the ones an attacker needs to touch:
+1. IdP/authentication logs (sign-in, MFA, admin role changes).  
+2. PKI/CA and backup infrastructure access logs.  
+3. Secret manager retrieval logs.  
+4. Privileged/admin action logs (EDR, cloud audit logs, AD/Entra audit logs).  
+5. Everything else, as capacity allows.
+
+## 3. Retention Tiering — Practical Setup
+- Hot/searchable tier: 90 days, fast query for active investigation.  
+- Warm/archived tier: remainder of retention period (per policy §2.3 table), cheaper storage, slower retrieval, still admissible for audits.  
+- Kill-chain system logs: consider a separate, stricter-access archive so a compromised SIEM admin account can't touch the evidence of its own misuse.
+
+## 4. Alert Tuning
+- Start narrow (break-glass checkout, kill-chain admin actions) and expand — broad noisy alerting trains responders to ignore alerts, which defeats the point.  
+- Review false-positive rate monthly for the first quarter after any new alert rule; quarterly thereafter.
+
+## 5. Checklist
+✅ Centralized log shipping configured for all kill-chain and privileged systems.  
+✅ Logs are append-only/WORM where the platform supports it.  
+✅ Real-time alert on break-glass checkout, verified with a test invocation.  
+✅ Retention schedule matches the table in policy §2.3, reviewed against [Data Retention & Disposal Policy](data_retention_disposal_policy.md) for personal-data-bearing logs.
+
+---
+
+## 6. References
+- **[NIST SP 800-92, Guide to Computer Security Log Management](https://csrc.nist.gov/pubs/sp/800/92/final)**  
+- **[CIS Controls v8.1 (Control 8)](https://www.cisecurity.org/controls/v8-1)**