log-management-nist-800-92

Start by defining logging objectives such as incident detection, compliance, or forensics, then prioritize log sources by asset risk. NIST SP 800-92 recommends documenting verbosity levels, review frequency, retention periods, and secure disposal procedures in a formal policy.

Critical sources include authentication servers, firewalls, IDS/IPS, and domain controllers because they detect unauthorized access. High-priority sources include web servers, databases, and VPNs, while DNS and cloud audit logs provide investigation context.

Retention depends on the framework: PCI DSS requires 12 months, HIPAA requires 6 years, SOX requires 7 years, and GDPR follows a purpose-based approach. Authentication logs generally need at least one year for forensic reconstruction.

NIST recommends centralized logging for all critical sources because it enables correlation, simplifies forensics, and eases compliance auditing. Decentralized approaches distribute load but fragment visibility and risk log loss, so centralization with redundancy is preferred.

Without synchronized timestamps, incident reconstruction across systems is impossible. All systems should use the same NTP source, log in UTC, and be audited for clock drift, since deviations over one second can break event correlation.

This guidance covers management practices, not tool-specific configuration for Splunk, ELK, or syslog-ng, and not hands-on forensic analysis. For threat modeling or incident response procedures, use dedicated skills for those domains instead.