# Logging, Monitoring & Retention Guidance

**Document owner:** [Owner/Role]  
**Approved by:** [Steering Committee / CISO]  
**Effective date:** [YYYY-MM-DD]  
**Review cadence:** [Annually]

---

## 1. Purpose & Scope
Implementation guidance for the [Logging, Monitoring & Retention Policy](logging_monitoring_policy.md). Applies to IT, security operations, and system owners.

---

## 2. Log Source Priority Checklist
Wire these up first — they're the ones an attacker needs to touch:
1. IdP/authentication logs (sign-in, MFA, admin role changes).  
2. PKI/CA and backup infrastructure access logs.  
3. Secret manager retrieval logs.  
4. Privileged/admin action logs (EDR, cloud audit logs, AD/Entra audit logs).  
5. Everything else, as capacity allows.

## 3. Retention Tiering — Practical Setup
- Hot/searchable tier: 90 days, fast query for active investigation.  
- Warm/archived tier: remainder of retention period (per policy §2.3 table), cheaper storage, slower retrieval, still admissible for audits.  
- Kill-chain system logs: consider a separate, stricter-access archive so a compromised SIEM admin account can't touch the evidence of its own misuse.

## 4. Alert Tuning
- Start narrow (break-glass checkout, kill-chain admin actions) and expand — broad noisy alerting trains responders to ignore alerts, which defeats the point.  
- Review false-positive rate monthly for the first quarter after any new alert rule; quarterly thereafter.

## 5. Checklist
✅ Centralized log shipping configured for all kill-chain and privileged systems.  
✅ Logs are append-only/WORM where the platform supports it.  
✅ Real-time alert on break-glass checkout, verified with a test invocation.  
✅ Retention schedule matches the table in policy §2.3, reviewed against [Data Retention & Disposal Policy](data_retention_disposal_policy.md) for personal-data-bearing logs.

---

## 6. References
- **[NIST SP 800-92, Guide to Computer Security Log Management](https://csrc.nist.gov/pubs/sp/800/92/final)**  
- **[CIS Controls v8.1 (Control 8)](https://www.cisecurity.org/controls/v8-1)**