Log Management for Security
Logs are the record you will desperately want during an incident — and the record attackers will try to erase. Good log management is the unglamorous foundation of detection and response: without trustworthy logs, “what happened?” has no answer. The goal is logs that are useful, centralized, protected, and kept long enough to matter.
What makes a log useful?#
A security-useful log answers the investigator’s questions:
- Who — the account or identity involved.
- What — the action taken and its outcome (success or failure).
- When — an accurate, synchronized timestamp.
- Where — source address, host, and context.
Consistent, synchronized time across systems is essential — correlating events in a SIEM is impossible if clocks disagree.
Centralize, protect, retain#
Three properties turn raw logs into reliable evidence:
| Property | Why it matters |
|---|---|
| Centralized | Survives compromise of the source host |
| Tamper-protected | Attackers cannot erase their tracks |
| Retained long enough | Breaches are found months later |
Shipping logs off the originating system is critical: an attacker who compromises a host can edit its local logs, but not the copy already sent to a protected central store.
Log management is the raw material of detection and response. More at the Defense & Hardening hub.
Frequently asked questions#
What makes a log useful for security?
A security-useful log records who did what, when, from where, and whether it succeeded, with accurate synchronized timestamps and enough context to reconstruct events. It should be centralized so it survives the compromise of the source system, and protected from tampering so an attacker cannot erase their tracks.
How long should you keep security logs?
Long enough to investigate incidents that are often discovered months after they begin — commonly a year or more for important logs, subject to legal and compliance requirements. Because attackers dwell undetected for extended periods, logs that only go back a few weeks may not cover the actual start of a breach.