Event logging enables applications and operating systems to record important software and hardware events.
This supports the continued delivery of operations and improves the security and resilience of critical systems by enabling network visibility.
Malicious cyber actors can compromise devices and leverage legitimate system tools to maintain a persistence in networks and avoid detection. Forwarding event logs to a central location allows organisations to analyse log data, enabling faster threat detection and incident response.
In the current cyber threat environment, effective logging has never been more crucial to maintain the security and integrity of vital systems and networks.
Use our best-practice guidance to establish effective event logging and spot threats sooner.
Best practices for event logging and threat detection
This publication defines a baseline for event logging best practice to mitigate cyber threats.
Implementing SIEM and SOAR platforms
SIEM and SOAR platforms can greatly benefit your organisation by collecting, centralising, and analysing important data, detecting cyber security events and incidents and prompting timely intervention.
Windows event logging and forwarding
This publication has been developed as a guide to the setup and configuration of Microsoft Windows event logging and forwarding.