Logging
Time-stamped records of what happened. Collect what can answer a question. If it never gets queried, it is storage spend.
Logging is the automatic, time-stamped record of events that matter to a system. A logging facility covers generation, transport, and storage. Event logging is what a SIEM then chews.
Minimum useful set: authentication, privileged use, endpoint process/network if you have EDR, cloud control-plane, mail gateway, VPN, DNS. Time sync, retention that outlasts your dwell-time assumption, write integrity so an intruder cannot quietly rewrite the story.
Map logs to detections and to IR questions. 'We have 90 days of everything' is not a strategy if nobody can search it at 2am.
Fact source: ASD's ACSC glossary. Wording is Cyberstack's.