Log management

Every system writes logs: sign-ins, process starts, firewall decisions, web requests, configuration changes. Log management is the discipline of making sure the right logs are actually generated, shipped to a central place, kept long enough, protected from tampering and searchable at investigation time. NIST SP 800-92 describes it as an organization-wide practice rather than a feature of a single tool.

The practical decisions are always the same: what to collect (not everything is worth the storage cost), how long to keep it (often driven by regulation and by how long attacks go unnoticed), where to store it (ideally outside the reach of an attacker who compromises the source system), and how to keep timestamps consistent, usually by synchronizing every clock with NTP and storing times in UTC.

Example

During an investigation, the team needs to know which accounts signed in to a file server three months ago. Domain controller logs are kept for a year in the SIEM, but the file server's own logs were stored locally and overwrote themselves after nine days. The answer depends entirely on decisions made long before the incident.

Why it matters for a SOC analyst

"We don't have logs for that" is one of the most common and frustrating findings in incident response. Learn which sources your SOC collects, their retention, and their gaps. When you find a blind spot during an investigation, write it down as a recommendation: fixing logging is cheap compared with investigating without it.