Log Management Package

The Anti-Vendor Philosophy

Centralized logging exists for one purpose: active detection and investigation. That needs 30–90 days of normalized, searchable data. Not 365 days. Not 7 years. If you need to investigate something from 8 months ago, you pull the raw logs from the machine or restore them from backup. You don't need them sitting in Elasticsearch burning RAM 24/7.

The Three Copies You Already Have

What You Already Have for Free vs The Gap

Already Covered (Free)

The Actual Gap

Beyond Machines: Containers, Kubernetes, Serverless, SaaS

Containers & Docker

Kubernetes

Serverless & Managed Services

SaaS Applications

The Pattern Is the Same

• Increase Windows Event Log sizes — defaults are 20MB per channel. At 20MB, Security logs overwrite in hours on a busy server. Set to 1GB minimum per channel (Security, System, PowerShell/Operational) via GPO.
  30 minFree
• Linux syslog retention — configure logrotate to keep 365 days compressed. Default is usually 4 weeks.
  15 min/serverFree
• Enable PowerShell Script Block Logging (GPO) — ransomware operators use PowerShell extensively. Without this, you're blind.
  15 minFree
• Enable Windows command-line process auditing — shows exactly what commands attackers ran. GPO: Audit Process Creation → Include command line.
  15 minFree

• IR log cheat sheet: Laminated card for each system type showing exactly which logs to pull and where they live during an incident. Not a 40-page document — a card.
• Pre-built log collection scripts: PowerShell/Bash scripts that grab the critical logs from a compromised machine, compress them, and copy to a safe location. Ready before you need them.
• Ensure on-host logs survive reboot and clearing: Forward critical events to a secondary local log file (Windows Event Forwarding to local collector, or rsyslog to a second file) so even if an attacker clears Event Viewer, the copy persists.

365 days of raw logs on every server. IR team can pull any log from any machine within minutes. Logs survive attacker clearing attempts via secondary local copy.

• Deploy Wazuh (free, open-source) as your SIEM. Agents on all servers and critical workstations. Receives logs, normalizes, indexes, alerts.
  1–2 daysFree / OSS
• Or deploy Grafana Loki — lightweight log aggregation. Doesn't index log content (cheaper), queries via labels. Good for mid-market that doesn't need full SIEM.
  Half dayFree / OSS
• Set retention to 90 days in your SIEM. Not 365. Not "as much as we can fit." 90 days covers the detection window for most attacks (median dwell time is 3–14 days). Older data lives on-host and in backup.
  15 minFree
• Alert on the things that matter (from the Config Drift playbook's 15 settings):
  • Legacy auth attempts (Event ID 4776 with legacy protocol)
  • Shadow copy deletion (Event ID 8225 or vssadmin process creation)
  • Backup service stopped (Event ID 7036)
  • RDP from unexpected sources
  • New admin group membership (Event ID 4732)
  • Off-hours admin activity (88% of ransomware deploys at night)
  2–4 hoursFree

• Detection rule library: Tuned to the 15 breach-forensic settings. Not 500 generic rules — 15–30 high-signal rules that detect the specific attack patterns from real incidents.
• Alert routing: Critical alerts go to phone/SMS/Signal 24/7. Not just an email that nobody reads on Saturday night.
• Log source prioritization: Not all sources are equal. Prioritize: domain controllers, VPN/firewall, email gateway, backup servers, file servers. Workstations are secondary.
• Retention tier configuration: Hot (30d, fully indexed), Warm (60d, compressed index), Delete at 90d. Older data is on-host and in backup.

30–90 days of searchable, normalized logs in SIEM. 15–30 high-signal detection rules running 24/7. Alerts reach humans at any hour. The SIEM is sized for detection, not storage.

• Alert on log source silence — if a machine that normally sends 1,000 events/day suddenly sends 0, something is wrong. Wazuh has built-in agent heartbeat monitoring.
  30 minFree
• Monthly log coverage check — how many machines should be logging vs how many actually are? The delta is your blind spot.
  30 min/monthFree
• Verify on-host log retention is actually at 365 days — GPO settings can be overridden locally, logrotate configs can change.
  15 min/quarterFree

• Log coverage dashboard: Single view showing every machine, its last log event, agent health, and on-host retention status.
• Automated enrollment: New machines auto-deploy the Wazuh agent via Intune/GPO/Ansible. No manual step = no machines missed.
• Detection rule health: Are your alert rules actually firing? A rule that never triggers is either perfect coverage or a broken rule. Test monthly.

100% log coverage verified continuously. Zero silent agent failures. Detection rules tested monthly. New machines automatically enrolled.

The Right Architecture for Mid-Market

[Every Server + Critical Workstation]
  |
  |-- On-host: 365d compressed logs (1GB+ Event Log channels, logrotate 365d)
  |            Cost: ~EUR 3/month per server (disk)
  |
  |-- Immutable backup: Logs included in machine backup (Borg/Restic/Kopia)
  |            Cost: EUR 0 incremental (already backing up the machine)
  |
  +-- Forward to central: Wazuh agent / rsyslog / Filebeat
       |
       v
[Central SIEM: Wazuh / Grafana Loki]
  Retention: 30-90 days normalized
  Purpose: Detection rules + investigation
  NOT for: Long-term storage (that's what copies 1+2 are for)
  Cost: 1 server, 4-8 cores, 16-32GB RAM, 500GB-1TB SSD
        = EUR 50-150/month self-hosted or existing hardware

• SIEM deployment: Single Wazuh server sized for your environment. Not a cluster. Not a managed cloud SIEM at €10K/month. One server that does the job.
• Log source isolation: SIEM on its own VLAN with separate admin credentials. If an attacker compromises production, they can't delete the SIEM's copy of the evidence. But remember — you also have on-host and backup copies.
• Tiered retention: SIEM at 30–90d, on-host at 365d, backup retention per your DR policy. Each tier serves a different purpose. Don't pay SIEM prices for backup-tier storage.
• NIS2 alignment: Article 21 requires incident handling capability. A functioning SIEM with detection rules + 365d on-host logs + immutable backups = compliance. You don't need Splunk Enterprise to satisfy the auditor.
• Insurance evidence: "Do you have logging and monitoring?" Yes — centralized SIEM with detection rules, on-host retention, and backup. Here's the dashboard. Here are the alert rules. Here's the last incident we detected and investigated.

Simple, right-sized logging infrastructure. One SIEM server. 30–90 days searchable. 365 days on-host. Backup covers everything. Detection rules tuned to real threats. No over-engineering. No vendor lock-in. No surprise bills.

What to Actually Log (and What Not To)

Must Centralize (High Detection Value)

Keep On-Host Only (Low Detection Value per GB)

Economics: Right-Sized vs Over-Engineered

Consulting Economics