policies/Security/logging_monitoring_guidance.md

Logging, Monitoring & Retention Guidance

Document owner: [Owner/Role]
Approved by: [Steering Committee / CISO]
Effective date: [YYYY-MM-DD]
Review cadence: [Annually]

---

1. Purpose & Scope

Implementation guidance for the Logging, Monitoring & Retention Policy. Applies to IT, security operations, and system owners.

---

2. Log Source Priority Checklist

Wire these up first — they're the ones an attacker needs to touch:

1. IdP/authentication logs (sign-in, MFA, admin role changes).
2. PKI/CA and backup infrastructure access logs.
3. Secret manager retrieval logs.
4. Privileged/admin action logs (EDR, cloud audit logs, AD/Entra audit logs).
5. Everything else, as capacity allows.

3. Retention Tiering — Practical Setup

• Hot/searchable tier: 90 days, fast query for active investigation.
• Warm/archived tier: remainder of retention period (per policy §2.3 table), cheaper storage, slower retrieval, still admissible for audits.
• Kill-chain system logs: consider a separate, stricter-access archive so a compromised SIEM admin account can't touch the evidence of its own misuse.

4. Alert Tuning

• Start narrow (break-glass checkout, kill-chain admin actions) and expand — broad noisy alerting trains responders to ignore alerts, which defeats the point.
• Review false-positive rate monthly for the first quarter after any new alert rule; quarterly thereafter.

5. Checklist

✅ Centralized log shipping configured for all kill-chain and privileged systems.
✅ Logs are append-only/WORM where the platform supports it.
✅ Real-time alert on break-glass checkout, verified with a test invocation.
✅ Retention schedule matches the table in policy §2.3, reviewed against Data Retention & Disposal Policy for personal-data-bearing logs.

---

6. References

• NIST SP 800-92, Guide to Computer Security Log Management
• CIS Controls v8.1 (Control 8)