Logging

Logging should be a top priority within security when first building out your program as it builds out accountability. It can help identify, diagnose, and troubleshoot any issues that can arise within your organization. This is often a difficult task as it involves years of dedicated effort to build out.

Tooling#

There are so many options out there when it comes to logging and below contains some open source options, minimal maintenance options, and enterprise products.

Open Source#

Open source projects can be a great way to get started in order to help reduce costs.

• ELK
• ECK
• OpenSearch
• Graylog

Minimal Effort#

When starting out your logging journey, you should consider low cost and effort options. As this is often an expensive time consuming journey, eliminating that as much as possible should be a priority. If you already have a mature program, most likely the below would best fit your needs.

• Amazon Security Lake
• Amazon Opensearch Serverless
• S3 + Athena
• BigQuery

Products#

Enterprise products can be invaluable when you have a mature program and the bells + whistles are a crucial component.

• ELK
• Splunk
• Sumo Logic
• QRadar
• Panther
• Amazon OpenSearch