Centralize Audit Logs
Description
Centralize, to the extent possible, audit log collection and retention across enterprise assets.
Implementation Checklist
Tool Recommendations
SIEM platform with log management, threat detection, investigation, and compliance reporting across enterprise data sources
Cisco (Splunk) · Ingest-based or workload-based
Cloud-native SIEM and SOAR with AI-driven analytics, automated threat response, and native Azure/M365 integration
Microsoft · Pay-as-you-go (per GB ingested)
AI-driven SIEM with behavioral analytics, automated investigation, and SOAR capabilities for threat detection
Exabeam · Per-user subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Cross-System Attack Patterns Lost in Distributed Logs
ConfidentialitySophisticated multi-stage attacks spanning multiple systems go undetected because logs remain on individual assets where each fragment appears benign, and only centralized correlation would reveal the complete attack pattern.
Log Destruction by Attackers on Compromised Hosts
IntegrityAttackers with administrative access to compromised systems delete or tamper with local log files to cover their tracks, and without centralized log collection these audit trails are permanently lost.
Delayed Breach Detection from Manual Log Review
ConfidentialityWithout centralized log aggregation, security analysts must manually access individual systems to review logs, dramatically increasing the time to detect breaches and extending attacker dwell time from days to months.
Vulnerabilities (When Safeguard Absent)
No Centralized SIEM or Log Aggregation Platform
Audit logs remain on individual assets with no centralized collection, making cross-system correlation impossible, increasing investigation time exponentially, and leaving logs vulnerable to local tampering by attackers.
Partial Log Forwarding with Missing Source Types
Log centralization covers only some asset categories while others (cloud services, network devices, Linux hosts) retain logs locally, creating blind spots in centralized monitoring and correlation capabilities.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Detection tool deployment evidence (dashboard screenshots, agent status) | Captured monthly |
| Technical | Sample alert/detection output demonstrating capability | Captured quarterly |
| Technical | SIEM dashboard showing log sources and collection status | Captured monthly |
| Record | Log review records and findings | Per review cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |