Detection and monitoring

Incident response assumes someone noticed. Most organizations that respond well to incidents found out from a customer, a vendor, or an extortion note, and the gap between compromise and discovery is where nearly all of the damage accumulates.

Decide what to log by asking what you would need afterward

Work backwards from the questions an investigation asks: who authenticated, from where, and what did they then do. That points at a short list that matters far more than volume.

• Identity events — authentication success and failure, MFA changes, privilege grants, new API keys and tokens, consent grants to applications.
• Endpoint process activity — what ran, what spawned it, what it connected to.
• Administrative actions in the platforms that hold your data, especially permission and sharing changes.
• Network egress where you have it, and DNS, which is cheap and unusually informative.

Retention decides whether you can investigate at all. Intrusions are commonly discovered months after entry, so logs kept for thirty days answer none of the useful questions. Split it: a short hot window you can search fast, and a longer cold archive you can still reach.

Centralize, and make the copy hard to erase

Logs stored only on the system that produced them are logs the attacker controls. Ship them off the host as they are written, to a destination with different credentials from the systems it collects from — otherwise one compromised administrator account ends both the intrusion and the evidence of it.

Write detections for behavior, not for events

A single event is almost never an incident. What distinguishes an attacker is a sequence: authentication from a new location, followed by a mailbox rule creation, followed by a bulk download.

• Start from the techniques that actually apply to you. Coverage is a property of your own estate, not of a vendor's rule count.
• Detect the steps an attacker cannot skip — persistence, privilege escalation, credential access, and exfiltration — rather than the tools they might use, which change.
• High-signal detections available cheaply: inbox rules that forward or delete externally, new federation or identity-provider trust, disabled logging, impossible travel on administrative accounts, and mass file access by a single principal.

Every detection needs a documented response. A detection that fires with no defined next step becomes noise on its second occurrence.

Tune ruthlessly, because alert fatigue is the real failure mode

An alert that is wrong most of the time trains people to close it without reading. The team stops noticing, and the eventual real one closes the same way.

Measure the proportion of alerts that are actually actioned. Anything consistently below roughly half is a tuning problem, and the fix is narrowing or suppressing the rule rather than adding another analyst. A smaller number of trustworthy detections beats broad coverage nobody believes.

Decide who is watching, and when

Coverage hours are an explicit decision with a cost. Business-hours monitoring means an intrusion starting on Friday evening runs unobserved for two days, which is exactly why attacks are timed that way. If you cannot staff around the clock, say so, and choose a small number of detections that page a human at any hour rather than pretending the queue is monitored.

Outsourcing detection is legitimate and does not outsource the decision. The provider escalates; someone inside still has to be reachable and authorized to disconnect something.

Test that it would actually fire

Detection coverage is assumed far more often than it is verified. Run the behavior — a benign version of the technique — and confirm the alert arrives, reaches a person, and carries enough context to act on. Coverage claimed from a configuration page is not coverage.

Sources

references/sources.md in this skill lists the outside authorities that settle the questions here — what each one is authoritative for, and what you may do with it. Check them before answering on anything they cover, and cite what you used. Most are free to read and not free to reproduce; the use note on each is binding.

Never

• Retain logs for a window shorter than the time it typically takes to discover an intrusion.
• Store the only copy of a log on the system it describes.
• Ship a detection with no defined response.
• Claim coverage for a technique nobody has tested end to end.