Translated from 日本語 • View original 
When implementing and operating SIEM (Security Information and Event Management), many security personnel are worried about
The question is, "Which logs should I integrate with my SIEM?"
More logs are not always better.
In SIEM, it is important to selectively collect and analyze "valuable logs" according to the purpose.
In this article, we will explain the types of logs that should be linked to SIEM and their priorities, in accordance with practical practice.
1. Start by organizing "why collect logs"
Before integrating logs into your SIEM, clarify your objectives:
- Early detection of unauthorized access and malware infection
- Investigate the cause and identify the scope of impact when an incident occurs
- Detection of internal fraud and suspicious operations
- Responding to audits, internal controls, and trail management
If you don't organize this,
"There are logs, but they cannot be analyzed" "Only costs increase"
It is easy to fall into a state of this.
2. Logs to be linked as a top priority: authentication and identity-related logs
The most important part of SIEM integration is authentication and identity-related logs.
Typical Logs
- Active Directory/Entra ID (formerly Azure AD) sign-in logs
- MFA (Multi-Factor Authentication) success and failure logs
- Admin privilege grant/change history
From these logs, the following detections are possible:
- Login from suspicious countries and IPs
- Continuous login failures (brute force)
- Privilege escalation and admin account abuse
** "Who, when, where, and what accessed what" is
This log is the starting point for any incident investigation, so it should be linked as a top priority.
3. Endpoint Logs
The next most important thing is the logs about endpoints such as PCs and servers.
Typical Logs
- EDR detection logs (malware, behavior detection, etc.)
- Suspicious process execution and script execution logs
- Device isolation and file isolation history
By linking these to your SIEM,
- Visualize attacks starting from device compromise
- Correlation analysis with authentication and communication logs
- Get a complete picture of the attack
It will be possible.
A major advantage of SIEM integration is that it allows you to understand the "attack flow across the entire environment" that cannot be seen by EDR alone.
4. Network and Communication Logs
Network logs can help identify signs of external attacks and information leaks.
Typical Logs
- Firewall communication permission/denial logs
- Proxy / Secure Web Gateway communication logs
- VPN/ZTNA connection logs
When you integrate these with your SIEM,
- Detection of suspicious communication destinations (such as C2 servers)
- Understand unusual communication volume and communication patterns
- Fraud detection combined with authentication logs
It will be possible.
However**, communication logs are very large and are easily related to costs**.
It is important to design to focus on "logs related to security events" rather than the full amount.
5. Cloud SaaS Operation Logs
Now that the use of cloud and SaaS has become commonplace, cloud operation logs are essential.
Typical Logs
- Azure/AWS/GCP administrative operation logs
- Microsoft 365 audit logs (Exchange, SharePoint, Teams, etc.)
- Configuration changelog by SaaS administrator
These logs allow you to
- Dangerous configuration changes and permission manipulation
- Suspicious file manipulation and mass downloads
- Internal fraud and account abuse
It can detect and investigate such events.
Especially if you're using Microsoft 365, you can use Microsoft Sentinel to
You can take advantage of these logs relatively easily.
6. Logs that don't necessarily need to be linked from the beginning
From the beginning of SIEM implementation, it is important to be careful to link the following logs unconditionally.
- Application access logs that are too detailed
- Logs for debugging applications
- Business logs not used for security decisions
These can lead to increased costs and operational loads.
In SIEM,
"I don't put in logs that can be added later."
The judgment is also very important.
7. Practical Recommendation: Start Small + Scale Up
In practice, it is recommended to proceed with log linkage in the following order.
- Authentication and identity related logs
- Endpoint (EDR) Logs
- Important Cloud SaaS Operation Logs
- Network and communication logs
Start with logs that are directly connected to detection and investigation.
By gradually expanding the range at the stage of getting used to the operation,
SIEM operations that are less likely to fail can be realized.
Summary: The value of a SIEM is determined by "log selection"
SIEM is not a "tool for collecting a lot of logs".
It is the foundation for collecting and analyzing logs necessary for security decisions at appropriate granularity.
- Clarify your purpose
- Integrate from high-priority logs
- Be aware of costs and operational loads
By being aware of these, SIEM becomes a strong security foundation.
Please proceed with the selection of logs tailored to your company's environment.
Colorkrew Security supports Microsoft Sentinel, a SIEM provided by Microsoft, from deployment to operation.
It is also possible to design the optimal implementation of logs and analysis policies that should be acquired while considering costs.
In addition, Microsoft Sentinel does not incur additional usage charges if it stops collecting logs.
It is also suitable for small starts, such as "I want to build an environment first and see what kind of analysis is possible."
If you are considering using or implementing Microsoft Sentinel, please feel free to contact us.