UnixTime

Research Note

Log Source and Retention Register

Use this register to track log sources, event types, retention periods, protection methods, and review ownership.

On this page

When to use this

Use this register to track log sources, event types, retention periods, protection methods, and review ownership.

Register

System/source Log type Events captured Destination Retention Protected from admin tampering? Review owner
TBD Audit/security/fault/admin TBD SIEM/log store TBD Yes/No TBD

Minimum checks

  • Critical systems are included.
  • Privileged activity is included.
  • Retention meets investigation needs.
  • Destination is protected.
  • Review owner is assigned.