Today we have released new guidance on Best practices for event logging and threat detection. It outlines best practice for event logging and threat detection for cloud services, enterprise information technology (IT) networks, enterprise mobility and operational technology (OT) networks.
The advice assumes a basic understanding of event logging and is intended primarily for cyber security practitioners, IT managers, OT operators, network administrators and network operators within medium to large organisations.
There are four key factors to consider when pursuing event logging and threat detection best practice:
- Develop an enterprise-approved logging policy.
- Centralise log collection and correlation.
- Maintain log integrity, including through secure log storage.
- Develop a detection strategy for relevant threats.
This publication has been released in cooperation with the following international partners:
- United States (US) Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI) and the National Security Agency (NSA)
- United Kingdom (UK) National Cyber Security Centre (NCSC-UK)
- Canadian Centre for Cyber Security (CCCS)
- New Zealand National Cyber Security Centre (NCSC-NZ) and Computer Emergency Response Team (CERT NZ)
- Japan National Center of Incident Readiness and Strategy for Cybersecurity (NISC) and Computer Emergency Response Team Coordination Center (JPCERT/CC)
- The Republic of Korea National Intelligence Services (NIS) and NIS’s National Cyber Security Center (NCSC-Korea)
- Singapore Cyber Security Agency (CSA)
- The Netherlands General Intelligence and Security Service (AIVD) and Military Intelligence and Security Service (MIVD).
To learn more about these key factors, read the Best practices for event logging and threat detection publication.