Chapter 3 — Log sources and coverage
Lesson map
Lesson 03 published. Map, example, EX011.
flowchart TD
N0["Learning outcomes"]
N1["3.1 Choosing sources"]
N2["Lab — measuring coverage"]
N3["3.2 Lab result"]
N4["3.3 Prioritising"]
N5["3.4 Retention and time"]
N6["3.5 Cost"]
N7["Audit settings"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX011"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["3.1 Choosing sources"]
N2["Lab — measuring coverage"]
N3["3.2 Lab result"]
N4["3.3 Prioritising"]
N5["3.4 Retention and time"]
N6["3.5 Cost"]
N7["Audit settings"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX011"]
[Learning outcomes]
|
v
[3.1 Choosing sources]
|
v
[Lab — measuring coverage]
|
v
[3.2 Lab result]
|
v
[3.3 Prioritising]
|
v
[3.4 Retention and time]
|
v
[3.5 Cost]
|
v
[Audit settings]
|
v
[Worked example] --> [Exercise EX011]
Learning outcomes
You will (1) choose log sources based on risk; (2) measure coverage of critical assets; (3) plan collection with SP 800-92 in mind; (4) prioritise gaps.
3.1 Choosing sources
NIST SP 800-92 (Kent and Souppaya, 2006) advises planning log management around what the organisation needs to know. Priya starts from the March case: she needed VPN logs, domain controller logs and file-server audit logs to understand it. Starting from March gives Priya a concrete test: could the SOC have seen and understood that event with the sources it collects? Each source she adds answers a question from the case: who logged in, what changed and which files were read. She then adds sources for the other critical assets on her list, such as the ERP server, and records the reason for each choice.
Lab — measuring coverage
"""Log coverage: which critical assets send logs to the SIEM (synthetic)."""
assets = {"DC1": "critical", "DC2": "critical", "ERP-SRV": "critical", "FILE1": "critical", "VPN-GW": "critical",
"PRINT1": "low", "CAD-WS01": "high", "CAD-WS02": "high", "HR-PC": "high", "SHOP-PLC-HMI": "high"}
sending = {"DC1", "DC2", "FILE1", "VPN-GW", "CAD-WS01", "HR-PC"}
for level in ("critical", "high", "low"):
names = [a for a, l in assets.items() if l == level]
have = [a for a in names if a in sending]
print(f"{level:8} {len(have)}/{len(names)} missing={sorted(set(names) - sending)}")
print(f"overall {len(sending)}/{len(assets)} = {100 * len(sending) // len(assets)}%")
Run with python3 lab_coverage.py. Verified output:
critical 4/5 missing=['ERP-SRV']
high 2/4 missing=['CAD-WS02', 'SHOP-PLC-HMI']
low 0/1 missing=['PRINT1']
overall 6/10 = 60%
3.2 Lab result
Overall, 6 of 10 listed assets send logs (60%). Four of five critical assets send logs; the ERP server does not. Of the high assets, CAD-WS02 and the factory HMI PC are missing. The print server is low priority. The lab counts assets that send logs, not how useful their logs are, so Priya checks each source's content as well. Missing the ERP server matters most, because it is critical and holds orders and prices. The two missing high assets match the kinds of systems involved in March or in production. Priya records the gaps and their reasons in the coverage table.
3.3 Prioritising
The ERP server holds orders and prices; it goes first. CAD-WS02 is a design workstation like the one used in March. The factory HMI needs care: the vendor must approve any agent, so Priya asks for network logs at the factory firewall instead. Prioritising by asset value and by the March case puts the most important gaps first. Network logs from the factory firewall are a compensating control for the HMI: they show its connections, even though nothing on the PC itself is logged. Priya records this in the risk register, with the vendor's position on agents and a date to review it. The board later approves the cost of collecting ERP logs.
3.4 Retention and time
Logs are kept 90 days searchable, one year archived; all systems sync to the same time source. Ninety days of searchable logs covers the time it usually takes to notice and investigate an incident. In March, the phishing email arrived two days before the login, so investigators needed several days of history. Keeping a year in archive allows a slower investigation, such as a customer asking months later whether its drawings were accessed. A shared time source means events from the VPN, domain controller and file server can be placed in one timeline, as the March investigation required.
3.5 Cost
The provider charges by data volume. Verbose debug logs are filtered out; security-relevant events are kept. Filtering debug logs reduces cost without losing events the SOC needs. Priya and the provider agree a list of events to keep for each source, starting with those used in the March investigation: VPN logins, admin group changes and file reads. Each month the provider reports data volumes, so Priya can see whether a source suddenly grows. Any filter that removes security-relevant events needs her approval, so cost savings do not quietly reduce what the SOC can see.
Audit settings
Sending logs is not enough if the events are not recorded. Priya checks that file-server auditing records reads on the design shares and that domain controllers record group changes. In March, file auditing had been switched on only a month earlier by chance; without it the 2,310 reads would have been invisible.
Ownership of collection
IT owns the agents; the provider confirms receipt.
Worked example
Two months later, coverage is 9 of 10. The factory HMI still has no agent, but firewall logs show its connections. Priya records the remaining gap and the compensating control in the risk register.
Synthetic case. Assets and coverage are synthetic.
Errors and limits
Coverage of an asset is not coverage of every event on it; check audit settings too.
Exercises
- EX011 — Starting point. How did Priya choose first sources? Rubric: 3 = from March case needs: VPN, DC, file audit; 2 = partial; 1 = vague; 0 = none.
- EX012 — Lab figures. Give the lab coverage figures. Rubric: 3 = 6/10=60%; critical 4/5 missing ERP; high 2/4; 2 = partial; 1 = one; 0 = none.
- EX013 — Factory HMI. How was the HMI gap handled? Rubric: 3 = firewall logs instead; vendor approval needed; recorded in risk register; 2 = partial; 1 = vague; 0 = none.
- EX014 — Cost control. How was log cost controlled? Rubric: 3 = filter debug logs; keep security events; 2 = partial; 1 = vague; 0 = none.
- EX015 — Coverage caveat. Why is asset coverage not enough? Rubric: 3 = audit settings may miss events; 2 = partial; 1 = vague; 0 = none.
Synthesis
Collect logs according to risk, measure coverage and record gaps with compensating controls.
Continue studying — chapter 03 of 12
← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →