The Log Sources Every SOC Actually Needs

When an incident review concludes that a detection "did not fire", the underlying cause is frequently that the relevant telemetry was never collected. Coverage gaps are less visible than rule gaps and considerably more damaging, because no amount of tuning can find activity that was never recorded.

Priority one: endpoint

Endpoint telemetry remains the highest-value source for most organisations because it is where attacker activity becomes concrete — processes execute, files are written, commands run.

The essentials are process creation with full command lines and parent-child relationships, script-engine activity, service and scheduled-task creation, and local account and privilege changes. Command-line capture in particular converts a vague "a process ran" into an investigable event.

Priority two: identity and authentication

Intrusions increasingly use valid credentials rather than malware, which makes identity telemetry decisive. Endpoint tooling may see nothing unusual when an attacker simply logs in.

• Successful and failed authentication, with source address and method.
• Multi-factor authentication events, including denials and fatigue-style repeated prompts.
• Privilege and group membership changes, especially additions to administrative groups.
• New credential or authentication-method registration on an account.
• Token issuance and, where available, session anomalies such as impossible travel.
• Directory and identity-provider administrative activity.

Priority three: cloud control plane

If you use cloud services at all, control-plane logs record who did what to your infrastructure — role assumption, permission changes, storage configuration, key access.

These are frequently not enabled, not centralised, or retained for far too short a period, and their absence is discovered during an incident rather than before one. Cloud compromise usually appears here first, well before anything shows up on an endpoint.

The commonly missing rest

• Email security — the most common initial access vector, yet its telemetry is often siloed in a separate console nobody correlates.
• DNS — high-volume but extremely useful for spotting command-and-control and exfiltration patterns.
• Network flow and egress — essential where endpoint agents cannot be installed, and for understanding what actually left.
• VPN and remote access — the perimeter for a distributed workforce.
• SaaS audit logs — file sharing, permission changes and administrative actions in the platforms holding your data.
• Application logs — authentication, authorisation failures and administrative actions inside your own products.
• Backup systems — attackers target backups before deploying ransomware, so backup deletion is a high-value alert.

Retention and coverage are policy decisions

Two questions decide whether an investigation is possible: how far back can you look, and what proportion of assets are actually reporting?

Dwell time can substantially exceed short retention windows, so thirty days of logs may simply not reach the beginning of an intrusion. Meanwhile telemetry coverage is almost always lower than teams assume — agents fail, new systems are deployed without onboarding, and nobody notices until the gap matters. Both deserve to be measured and reported like any other control.

Related from TechBiz Security

• SOC services
• Managed security services
• Threat hunting

Sources & further reading

• NIST SP 800-92 — Guide to Computer Security Log Management
• CISA — Logging Made Easy
• MITRE ATT&CK — Data Sources
• CISA — Cybersecurity Advisories

Frequently asked questions