What Is Security Logging?

Definition

Security logging is the practice of recording security-relevant events, such as sign-ins, permission changes, file access, and configuration changes, and keeping those records where they cannot be quietly altered. Logs are how a business detects an attack in progress and later proves what an attacker did and did not touch.

How It Works

Nearly every system can write an event log: firewalls, servers, laptops, Microsoft 365, website hosting panels. The hard part is choosing what to keep, where to send it, and how long to hold it.

The joint guide Best Practices for Event Logging and Threat Detection, published in August 2024 by Australia's ASD with CISA, the FBI, the NSA, and other partners, names four key factors:

An enterprise-approved logging policy that says which events are captured on which systems.
Centralised log collection and correlation, so events from many systems can be read together.
Secure storage and log integrity, so an intruder cannot delete or edit the evidence.
A detection strategy for the threats that matter to you.

The guide also warns that "default log retention periods are often insufficient" and that it can take up to 18 months to discover an incident. NIST SP 800-92, the Guide to Computer Security Log Management, covers the same lifecycle: generating, transmitting, storing, analyzing, and disposing of log data.

Logging is a precondition, not a defense on its own. It only helps if the right events are switched on before an incident and someone, or something, reads them.

Real-World Example

In May and June 2023, the group Storm-0558 used forged authentication tokens to get into the Microsoft Exchange Online mailboxes of 22 organizations, including US government agencies. The Cyber Safety Review Board's review found that the Department of Commerce, a victim, "could not view past activity" because the detailed mailbox access logs "only captured data from the time that Microsoft enabled the advanced logging." Commerce had not bought the license tier that included those logs. The Board recommended that cloud providers adopt a minimum standard for default audit logging, so customers are not left blind.

Why It Matters for a Small Business

When something goes wrong, the first questions are: how did they get in, what did they take, and are they still here? Without logs, nobody can answer those questions with confidence. That uncertainty drives cost, because a business may have to assume the worst about which data was exposed, and it makes it harder to tell customers, insurers, or regulators exactly what happened. Many small businesses run cloud services on default settings, which may not record or keep what an investigation needs. Turning the right logs on costs little compared with an investigation that has nothing to work with.

How to Spot It / How DTS Handles It

Warning signs: nobody knows where sign-in logs are kept, the mailbox audit log is off or limited by your license, retention is the default, or logs live only on the machine that would be attacked.

DTS can help with checking which audit logs your Microsoft 365 tenant, servers, firewalls, and website host actually record, turning on the missing ones, and forwarding them to central storage that attackers cannot edit, with retention set by risk. See our managed IT service.

Related Terms

SIEM: the tool that collects and analyzes logs.
Log retention: how long logs are kept.
Log preservation: protecting logs as evidence once an incident starts.
Indicators of compromise: what investigators search logs for.
Dwell time: why logs must reach back months.
EDR: a rich source of endpoint logs.
Incident response: the process logs make possible.

Sources

ASD, CISA, FBI, NSA and partners, Best Practices for Event Logging and Threat Detection (August 2024): https://www.cisa.gov/resources-tools/resources/best-practices-event-logging-and-threat-detection
NIST, SP 800-92, Guide to Computer Security Log Management (2006): https://csrc.nist.gov/pubs/sp/800/92/final
Cyber Safety Review Board, Review of the Summer 2023 Microsoft Exchange Online Intrusion (March 2024): https://www.cisa.gov/sites/default/files/2025-03/CSRBReviewOfTheSummer2023MEOIntrusion508.pdf

Last updated October 14, 2026.