Prevention will eventually fail somewhere, and when it does, the question becomes how quickly you notice. Logs are the record of what happened on your systems. Without them, an intrusion can run for weeks unseen, and investigating afterward becomes guesswork. With too many of them and no plan, you drown in noise. This guide helps a small team find a workable middle ground.

What Logs Are For

Logs serve three purposes. Detection: spotting suspicious activity as or soon after it happens. Investigation: reconstructing what an attacker or a mistake actually did. Accountability: showing who accessed or changed what, which matters for audits and for fair handling of disputes.

None of these requires a specialist platform on day one. It requires deciding what to collect, where to keep it, and which few events genuinely deserve a person’s attention.

Start With the Sources That Matter Most

Not every system needs the same scrutiny. Prioritize the sources where attackers are most likely to leave traces:

• Identity and sign-in logs: successful and failed logins, new devices, unusual locations, MFA changes and password resets.
• Email platform logs: forwarding rule creation, mailbox access by delegates, unusual sending volume.
• Cloud administration logs: changes to permissions, new access keys, storage sharing changes, disabled logging.
• Endpoint protection alerts: detected malware, blocked behavior, disabled protection.
• Firewall and VPN logs: remote access sessions and blocked connection attempts.
• Server and application logs: administrative actions and errors on key systems.

Check each vendor’s current documentation to learn how to enable and export their logs, since many valuable ones are not on by default.

Events Worth Alerting On

Alerts should be rare and meaningful. A common beginner mistake is alerting on everything, which trains people to ignore the channel. Begin with a short list of high-signal events.

Event	Why it matters	Suggested response
Sign-in from an unexpected location or device	Possible stolen credentials	Contact the user; reset and revoke sessions if unconfirmed
Many failed logins followed by success	Possible password guessing	Lock or verify the account
New administrator account or role grant	Possible privilege abuse	Confirm it was authorized
MFA method added or removed	Attacker persistence	Verify with the user directly
Mailbox forwarding rule created	Common data theft tactic	Inspect and remove if unauthorized
Logging or security tool disabled	Attacker covering tracks	Investigate immediately
Mass file download or deletion	Exfiltration or ransomware	Isolate the account or device

Tune thresholds against your normal activity. Alerts that fire daily for harmless reasons should be adjusted or removed.

Where to Keep Logs

Logs held only on the system they describe can be erased by whoever compromises that system. Wherever practical, send them to a separate location with restricted access, such as a log service, a managed detection provider or storage under different credentials. Decide how long to retain them, balancing investigative needs with storage and privacy considerations. Because logs can contain personal information, apply access controls, and ask a qualified professional about retention rules that apply in your jurisdiction.

Synchronize clocks across systems. Logs with inconsistent timestamps make it very hard to piece together a sequence of events.

A Realistic Example

Imagine a hypothetical sixteen-person engineering firm with one IT administrator. After reading about logging, the administrator enables sign-in and mailbox audit logging in the email platform and sets alerts for three events: new forwarding rules, sign-ins from new countries and changes to MFA methods. Some weeks later, an alert shows a forwarding rule created on an employee’s mailbox, sending copies of incoming mail to an unfamiliar outside address. The administrator contacts the employee, who knows nothing about it, then removes the rule, resets the password, revokes sessions and finds the cause: a credential entered on a fake login page. Because logging was already on, the administrator can see precisely when the rule was created and confirm that no other mailboxes were affected. Three well-chosen alerts, not a complex platform, turned a potentially long-running leak into a same-day fix.

Making Monitoring Sustainable

Assign ownership. An alert that goes to a shared mailbox nobody reads is the same as no alert. Decide who receives notifications, who covers when they are away, and what counts as urgent outside working hours. Where you cannot staff that, consider a managed monitoring service, evaluating providers carefully and checking what is actually included.

Review weekly or monthly even when nothing fires. A short routine look at sign-in anomalies, new accounts and failed backups often catches things that thresholds miss. Test your alerts occasionally by performing a harmless trigger, such as a sign-in from a new device, to confirm they actually arrive.

Document a basic response playbook for your top alerts: what to check first, whom to contact and when to escalate. A short runbook shortens reaction time and reduces panic.

Common Pitfalls

• Collecting everything but reviewing nothing.
• Leaving default retention that discards evidence within days.
• Failing to log administrative actions in the cloud.
• Storing logs where attackers with admin rights can delete them.
• Forgetting to monitor the monitoring: alert when log sources stop sending data.

Frequently Asked Questions

Do we need a SIEM? Not at the start. A SIEM, which gathers and analyzes logs centrally, becomes useful as your environment grows, but many small teams get real value from built-in alerts in their email, identity and endpoint tools.

How long should we keep logs? Long enough to investigate incidents that are discovered late, balanced against storage cost and privacy obligations. Check applicable requirements with a qualified professional, as they vary.

What is the first log to turn on? Sign-in and administrator activity logs for your identity and email platforms, because account compromise is among the most common starting points.

How do we avoid alert fatigue? Start with a handful of high-signal alerts, tune out noisy ones, and add new ones gradually. Every alert should have a clear owner and a defined response.

Can we outsource monitoring? Yes, many providers offer it. Evaluate what they monitor, how quickly they respond, and what they need from you, and keep someone internal accountable for acting on their findings.

Next Step

Enable audit logging on your email and identity platforms today, then create three alerts: new forwarding rules, new administrator accounts and changes to MFA methods.