Configure syslog, rsyslog, Windows Event Forwarding (WEF). Centralized log collection. Compliance retention.
Logs are your primary source of truth during incidents. Without centralized logging and proper retention, you're blind. Advanced logging collects events from every host, network device, and application—then ships them to a central SIEM for analysis, detection, and compliance.
Syslog is the default logging protocol for Linux/Unix. It collects logs from kernel, auth, cron, apps, and sends them to /var/log or a remote server.
# /etc/rsyslog.conf # Forward all logs to remote SIEM at 10.0.1.100:514 *.* @10.0.1.100:514 # UDP *.* @@10.0.1.100:514 # TCP (more reliable) # Or save specific logs locally auth,authpriv.* /var/log/auth.log kern.* /var/log/kern.log
💡 Best Practice: Use TCP for critical logs (auth, security). UDP can drop packets under load.
WEF centralizes Windows Event Logs from all domain computers to a Windows Event Collector (WEC) server. No third-party agents needed—built into Windows.
winrm quickconfig💡 Install Sysmon on all Windows hosts for enhanced visibility (process trees, network connections, DLL injection).
Log shippers read logs from files or event streams and forward them to a SIEM (Splunk, Elastic, QRadar). They handle parsing, filtering, buffering.
Lightweight, purpose-built for log shipping to Elastic Stack
Open-source, cloud-native, highly extensible
ETL pipeline for logs—parse, transform, enrich
Windows-first log collector
Compliance standards (PCI-DSS, HIPAA, GDPR, SOX) require specific log retention periods. Failure = fines, audit failures.
3 months online + 1 year archived. Security logs for all payment systems, firewalls, web servers.
6 years minimum. All access to PHI (Protected Health Information) must be logged + auditable.
No fixed requirement but recommend 90 days for security logs. Must demonstrate breach detection capability.
7 years for financial systems. All database access, admin actions, config changes.
SSH logins, RDP sessions, VPN connections, AD authentication (success + failures)
Firewall allow/deny, IDS/IPS alerts, DNS queries, proxy logs, NetFlow
Process creation, file modifications, registry changes, service starts/stops (use Sysmon!)
AWS CloudTrail, Azure Activity Logs, Google Cloud Audit Logs (who did what in cloud)
User creation, privilege escalation, config changes, sudo usage
Equifax was breached for 76 days before detection. One reason: expired SSL certificate on log forwarding broke centralized logging. Attackers moved laterally undetected.
Monitor log sources, view real-time log streams, and troubleshoot collection issues.
Authentication
Active Directory
Network
Application