Select and set up logs for analysis and alerting
During a security investigation, you need to be able to review relevant logs to record
and understand the full scope and timeline of the incident. Logs are also required for alert
generation, indicating certain actions of interest have happened. It is critical to select,
enable, store, and set up querying and retrieval mechanisms, and set up alerting. Each of
these actions are reviewed in this section. For more details, see the Logging strategies for security incident response
