logging detection IR acsc-glossary
Logging
Time-stamped records of what happened. Collect what can answer a question. If it never gets queried, it is storage spend.
Short, tagged, searchable.
Terms, frameworks, and concepts used on an Australian defensive desk. No exploit steps.
AllIRacsc-glossaryau-compliancecloudconceptsdetectionframeworkshardeningidentityloggingmalwarenetworkvulnerability
2 entries
detection logging
SIEM
Security information and event management: collect, normalise, correlate, alert. Useless if nobody owns the queue.
Definitions informed by ASD's ACSC glossary. cyber.gov.au glossary