43 lines
2.1 KiB
Markdown
43 lines
2.1 KiB
Markdown
# Logging, Monitoring & Retention Guidance
|
|
|
|
**Document owner:** [Owner/Role]
|
|
**Approved by:** [Steering Committee / CISO]
|
|
**Effective date:** [YYYY-MM-DD]
|
|
**Review cadence:** [Annually]
|
|
|
|
---
|
|
|
|
## 1. Purpose & Scope
|
|
Implementation guidance for the [Logging, Monitoring & Retention Policy](logging_monitoring_policy.md). Applies to IT, security operations, and system owners.
|
|
|
|
---
|
|
|
|
## 2. Log Source Priority Checklist
|
|
Wire these up first — they're the ones an attacker needs to touch:
|
|
1. IdP/authentication logs (sign-in, MFA, admin role changes).
|
|
2. PKI/CA and backup infrastructure access logs.
|
|
3. Secret manager retrieval logs.
|
|
4. Privileged/admin action logs (EDR, cloud audit logs, AD/Entra audit logs).
|
|
5. Everything else, as capacity allows.
|
|
|
|
## 3. Retention Tiering — Practical Setup
|
|
- Hot/searchable tier: 90 days, fast query for active investigation.
|
|
- Warm/archived tier: remainder of retention period (per policy §2.3 table), cheaper storage, slower retrieval, still admissible for audits.
|
|
- Kill-chain system logs: consider a separate, stricter-access archive so a compromised SIEM admin account can't touch the evidence of its own misuse.
|
|
|
|
## 4. Alert Tuning
|
|
- Start narrow (break-glass checkout, kill-chain admin actions) and expand — broad noisy alerting trains responders to ignore alerts, which defeats the point.
|
|
- Review false-positive rate monthly for the first quarter after any new alert rule; quarterly thereafter.
|
|
|
|
## 5. Checklist
|
|
✅ Centralized log shipping configured for all kill-chain and privileged systems.
|
|
✅ Logs are append-only/WORM where the platform supports it.
|
|
✅ Real-time alert on break-glass checkout, verified with a test invocation.
|
|
✅ Retention schedule matches the table in policy §2.3, reviewed against [Data Retention & Disposal Policy](data_retention_disposal_policy.md) for personal-data-bearing logs.
|
|
|
|
---
|
|
|
|
## 6. References
|
|
- **[NIST SP 800-92, Guide to Computer Security Log Management](https://csrc.nist.gov/pubs/sp/800/92/final)**
|
|
- **[CIS Controls v8.1 (Control 8)](https://www.cisecurity.org/controls/v8-1)**
|