Detection and monitoring

Incident response assumes someone noticed. Most organizations that respond well to incidents found out from a customer, a vendor, or an extortion note, and the gap between compromise and discovery is where nearly all of the damage accumulates.

Decide what to log by asking what you would need afterward

Work backwards from the questions an investigation asks: who authenticated, from where, and what did they then do. That points at a short list that matters far more than volume.

• Identity events — authentication success and failure, MFA changes, privilege grants, new API keys and tokens, consent grants to applications.
• Endpoint process activity — what ran, what spawned it, what it connected to.
• Administrative actions in the platforms that hold your data, especially permission and sharing changes.
• Network egress where you have it, and DNS, which is cheap and unusually informative.