detection-and-monitoring

Detection and monitoring

Incident response assumes someone noticed. Most organizations that respond well to incidents found out from a customer, a vendor, or an extortion note, and the gap between compromise and discovery is where nearly all of the damage accumulates.

Decide what to log by asking what you would need afterward

Work backwards from the questions an investigation asks: who authenticated, from where, and what did they then do. That points at a short list that matters far more than volume.

• Identity events — authentication success and failure, MFA changes, privilege grants, new API keys and tokens, consent grants to applications.
• Endpoint process activity — what ran, what spawned it, what it connected to.
• Administrative actions in the platforms that hold your data, especially permission and sharing changes.
• Network egress where you have it, and DNS, which is cheap and unusually informative.

Retention decides whether you can investigate at all. Intrusions are commonly discovered months after entry, so logs kept for thirty days answer none of the useful questions. Split it: a short hot window you can search fast, and a longer cold archive you can still reach.

Centralize, and make the copy hard to erase

Logs stored only on the system that produced them are logs the attacker controls. Ship them off the host as they are written, to a destination with different credentials from the systems it collects from — otherwise one compromised administrator account ends both the intrusion and the evidence of it.

Write detections for behavior, not for events

A single event is almost never an incident. What distinguishes an attacker is a sequence: authentication from a new location, followed by a mailbox rule creation, followed by a bulk download.

• Start from the techniques that actually apply to you. Coverage is a property of your own estate, not of a vendor's rule count.
• Detect the steps an attacker cannot skip — persistence, privilege escalation, credential access, and exfiltration — rather than the tools they might use, which change.
• High-signal detections available cheaply: inbox rules that forward or delete externally, new federation or identity-provider trust, disabled logging, impossible travel on administrative accounts, and mass file access by a single principal.