Identify log sources that will provide you with information that would be useful when performing security monitoring.
Having followed the principles set out in the Operating Model page, you should have a fairly comprehensive understanding of your system and its architecture. You should also have an idea of the threat and sophistication of attack that you are trying to detect within your system.
The next step is to identify log sources within your organisation (or customer systems) that will provide you with information that would be useful when performing security monitoring. This is where threat modelling can be useful, as it will enable you to identify valuable log sources and provide a rationale as to why you should collect them.
In addition to being used for detection, log sources are also vital in performing incident response as they can provide valuable context around system behaviour in the event of an incident.
Types of data source
With the goal of staying technology agnostic, this guidance will not enumerate every type of log source. However, sources can be split into four broad categories that should be considered.
Application - Arguably the widest and most varied scope. Logs provided by applications will often provide an invaluable insight into user actions.
Host - These logs typically refer to operating system and application logs. Often getting these will involve deploying an agent to the device. An example being the NCSC Logging made easy.
Network - Logs from network devices and infrastructure can provide vital information about connected devices and services across your estate.
Cloud - Cloud logs can include all of the above data sources, but there are some services that fall outside these categories, such as cloud management and compute services. These services will typically provide their own logs, which contain a wealth of useful information.
Before delving into the process of systematically identifying log sources, there are some quick wins for monitoring.
Authentication - These logs will allow the SOC to identify where and when users logged onto a system - or attempted to logon to a system. These logs provide big red flags when adversaries attempt to gain unauthorised access to systems.
Security Controls - This can include anti-malware software, security controls such as firewalls, access control list changes and anything that performs a security function within the organisation. Similarly to above, the logs provided by these controls are must haves as they will provide a first indication of something going wrong.
DNS - These logs can be invaluable in identifying malicious behaviour within an organisation. An example could be “EUD123 has requested www[.]n0t-m4lw4re[.]com” - which may provide the first indications of a compromised device, allowing the SOC to intervene.
