Collecting and analysing system and application logs to detect security incidents and support investigations.
Log monitoring involves collecting, storing, and analysing logs from across your IT environment—servers, applications, firewalls, endpoints, and cloud services. Logs record events like user logins, file access, system changes, and network connections. Security teams analyse logs to detect suspicious patterns (like multiple failed logins or unusual data access), investigate incidents (tracing attacker activity), and demonstrate compliance (proving who accessed what and when). Effective log monitoring requires centralised collection, adequate retention periods, and either automated analysis or regular human review.
Why It Matters
The DSC Perspective:
Logs are your evidence. When something goes wrong, logs tell you what happened. Compliance frameworks universally require log collection and retention—ISO 27001, Cyber Essentials Plus, NIS2, and customer questionnaires all ask about logging. SIEM makes log monitoring practical at scale.