Collect evidence across systems

Logging starts with configuration at the source: which actions are recorded, which fields identify the actor and object, and whether failures are included. Ingestion moves these records into an analysis system. Parsing gives fields consistent meanings, but the original record should remain available because a parser can drop information or interpret a field incorrectly.

Plan for interruptions as well as normal delivery. A collector queue, delivery delay metric, and alert for missing sources help distinguish an uneventful hour from a broken pipeline. Protect transport and storage, restrict log administration, and record access. Retention should reflect investigation needs, business requirements, storage costs, and the organisation’s approved policy.

Record the event time, time zone, ingestion time, and source identity. Synchronised clocks make correlation easier, but analysts still need to recognise drift, delayed delivery, and daylight-saving ambiguity. Do not silently reorder contradictory evidence into a convenient story. Keep the original timestamp and describe any conversion or correction used in your analysis.

Integrity means more than making logs searchable. Separate the permissions to operate a workload from permission to erase its central audit trail. Protect retained copies against inappropriate modification, monitor configuration changes, and test retrieval. A retention setting is useful only if the relevant records actually arrive and can be recovered when a case needs them.

On an endpoint, connect processes to their parent, account, executable location, and changes to critical files. Useful locations include Windows system and application directories and Linux configuration, executable, and log directories. A familiar filename in an unusual location deserves investigation. Hardening establishes approved configurations, limits unnecessary services, and gives you a baseline against which to assess drift.

Virtual machines have guest operating systems whose activity may require guest-level telemetry. Containers usually share a host kernel, so container identity, image, runtime, and orchestrator events add context that a process name lacks. Cloud-native services may be short-lived or managed by a provider. Collect control-plane and application API audit events, rather than assuming a server agent can observe everything.