Security logging coverage and retention worksheet

How to use this resource

Start with investigation questions, then work back to systems and events.

• Name the service, business owner, technical owner, security owner, and review date.
• Define the incidents, outages, misuse, and change scenarios logging must help investigate.
• Record response time, retention, access restrictions, and evidence-handling expectations.
• Sample real events and searches; an enabled integration is not proof of usable evidence.
• Do not copy raw logs, personal information, credentials, or tokens into the worksheet; record protected evidence references instead.
• Classify the completed worksheet as sensitive security information and keep it in an approved, restricted location with access controls.
• Agree who may access the worksheet, how evidence is referenced, and the retention and secure disposal requirements before collection begins.
• Track blind spots, parsing failures, clock errors, and retention gaps to owners and retest dates.

1. Investigation questions

• Who authenticated, from which device and location, using which method?
• What privilege did the identity have at the time?
• Which resource, record, host, application, or network path was accessed?
• What configuration, policy, role, object, or data changed, and what was the prior state?
• Which process, command, API client, automation, or administrator initiated it?
• What failed before success, and were controls bypassed or disabled?
• Which systems saw the same identity, address, device, or correlation identifier?
• Can the timeline be reconstructed with trustworthy timestamps?
• Can responders determine containment scope and verify remediation?

2. Source inventory

• Identity, directory, federation, multifactor, and privileged-access systems.
• Endpoint, operating-system, server, hypervisor, and management-plane logs.
• Firewall, VPN, zero-trust, DNS, DHCP, proxy, wireless, routing, and flow records.
• Cloud control plane, SaaS audit, email, collaboration, and file-sharing events.
• Application authentication, authorization, transaction, error, and administrative trails.
• Database, backup, storage, key-management, certificate, and secrets-platform events.
• Vulnerability, configuration, deployment, source-control, automation, and change records.
• For each source, record owner, collector, format, expected volume, health signal, and destination.

3. Event and field validation

• Generate representative successful and failed authentication events.
• Generate a role or policy change through an approved test path.
• Confirm account, device, source, target, action, outcome, and timestamp fields.
• Confirm stable identifiers survive display-name, address, and hostname changes.
• Check parsing, mapping, normalization, enrichment, and duplicate suppression.
• Identify truncation, sampling, aggregation, redaction, or provider limits.
• Verify time synchronization, source time zone, and clock precision.
• Record the exact search used to retrieve the test event.

4. Collection reliability and integrity

• Monitor collectors, forwarders, APIs, queues, storage, and parsers.
• Alert when events stop, volume changes, credentials expire, or ingestion is delayed.
• Define buffering and replay during network or destination outages.
• Protect collection configuration and storage from ordinary source administrators.
• Record encryption, access roles, administrative logging, and export controls.
• Test interruption behaviour only in an authorized non-production path or approved maintenance window with an owner, monitoring, stop conditions, and rollback.
• Never interrupt production logging solely to test collection; use existing incidents or controlled simulations when a safe live test is not approved.
• Back up critical queries, parsers, dashboards, and detection logic.
• Document provider dependencies, quotas, rate limits, and cost controls.

5. Retention and response use

• Define searchable, archived, and total retention by source and investigation need.
• Confirm effective settings rather than relying on defaults.
• Estimate cost using observed volume, growth, indexing, archive, and retrieval.
• Record privacy, legal, contractual, insurer, and sector requirements for qualified review.
• Limit log access and record searches, exports, changes, and deletion.
• Test retrieval from recent and archived data.
• Map priority detections to sources, fields, thresholds, owner, and response path.
• Test representative alerts from source event through triage and closure.

6. Gap and improvement register

• Record the missing question or event, affected service, consequence, and workaround.
• Classify the gap as source, configuration, transport, parsing, retention, access, detection, or response.
• Prioritize gaps that prevent scoping, containment, recovery validation, or accountability.
• Assign an owner, dependency, target date, verification step, and residual-risk decision.
• Close gaps only after a representative event can be retrieved and used as intended.
• Retest after platform, collector, licence, and architecture changes.

Important limitations

• Logging improves evidence and detection but does not prevent compromise or prove every action was recorded.
• Retention and monitoring may involve privacy, employment, legal, contractual, and sector requirements.
• Tests must use authorized accounts and data and avoid harmful production activity.