Skip to main content
All measures

Measure · ISO 27001

Collect and analyse logs securely

Connect relevant events to protected records, reliable time and a working detection and response path.

Accountable: IT operations with the responsible security analystsReviewed

Reuse existing records

Reuse log sources, monitoring and the incident record. Shared rules remain in the operations policy; specific sources, parameters and results stay with the service.

What to do

  1. 1

    Define purpose, sources and normal behaviour

    Select relevant activities, access, changes, faults and security events for the service. Specify necessary attributes such as identity, source, time, outcome and system. Include relevant network, application and, where needed, physical access events. Determine lawful scope, retention, ownership and normal behaviour including peaks; do not collect passwords, tokens or unnecessary personal content.

  2. 2

    Implement a protected event chain

    Configure selected sources. Use approved trusted time sources and unambiguous timestamps; define required accuracy and monitor differences. Record uncontrollable external-service offsets for analysis. Protect transport with suitable authenticated encrypted connections and storage against loss, unauthorised changes and access. Users should not be able to erase or disable records of their own activities unnoticed. Monitor collection failures and storage limits.

  3. 3

    Detect, report and investigate

    Configure rules and thresholds against expected behaviour. Use ongoing monitoring with real-time or interval analysis suited to needs. A known recipient and fallback path must be able to receive alerts. Follow a suitable harmless test from event and time correlation through alert to assessment. Investigate suspicious cases in the existing incident record and preserve necessary evidence.

  4. 4

    Maintain analysis and protection

    Address false positives and failed sources. Review rules after changes and new findings, recording material updates with the service. Remove or mask unnecessary sensitive details before authorised supplier disclosure. Keep actual assessments and corrections in the existing record.

Worked example

An operational example

Fictional example: Repeated failed logins reach a service, followed by use of a privileged account.

Assess the relationship
DecisionAnalysts correlate events using checked times, examine expected behaviour and route a reasoned suspicion to incident response.
EvidenceProtected events and traceable assessment in the existing record.

Record the result

  • Defined sources, purpose, retention, time sources and responsible analysis.
  • Actually received protected logs and a tested detection chain including response.

Common implementation mistakes

Buying a SIEM and ignoring alerts

A tool does not replace appropriate sources, rules, reachable recipients and competent assessment. Reuse existing functions when they achieve the result.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards

Templates for your implementation

Related resources

Sources and further reading