During an incident, logs are either your best friend or a wall of noise. The difference is decided long before anything breaks.
1. Log in a structured format
{"time":"2026-01-19T09:42:11Z","level":"warn","service":"payments","event":"login_failed","user":"j.doe","ip":"203.0.113.24"}Structured logs can be filtered and aggregated. Free-text logs can only be read one line at a time.
2. Include the “who” and the “where”
Every security-relevant event should say which user, from which address, on which system.
3. Use consistent timestamps
Log in UTC with ISO 8601 timestamps. Correlating events across servers in different time zones by hand is slow and error-prone.
4. Centralise and protect logs
Send logs off the host they came from. An attacker who gains access to a server shouldn’t be able to erase the evidence.
5. Keep them long enough
Many intrusions are discovered weeks later. Agree retention with your security and compliance teams — 90 days searchable is a common minimum.
