UnixTime

Research Note

Logging and Monitoring Standard

Use this standard to define loggable events, minimum log fields, retention, protection, review, and escalation requirements.

On this page

When to use this

Use this standard to define loggable events, minimum log fields, retention, protection, review, and escalation requirements.

Logging requirements

Event/source type Minimum fields Retention Protection Review frequency Escalation trigger
Privileged activity User/event/time/source/action TBD Central/protected TBD TBD
Failed access attempts User/source/time/result TBD TBD TBD TBD
Configuration changes User/change/time/system TBD TBD TBD TBD
Faults/exceptions System/fault/time/impact TBD TBD TBD TBD

Minimum checks

  • Loggable events are risk-based.
  • Minimum log fields are defined.
  • Retention is defined.
  • Logs are protected from tampering.
  • Review responsibility is assigned.
  • Alert escalation is defined.