Topic starter
21/08/2026 4:44 pm
TL;DR: Effective event logging now depends on structured schemas, reliable UTC timestamps, prioritized source coverage, and retention long enough to outlast dwell time, according to Axoflow. Log pipelines need trustworthy fields and history, or correlation and investigations lose the sequence analysts depend on.
Editorial analysis by NHI Mgmt Group, based on content published by Axoflow: “ASD's ACSC Best Practices for Event Logging and Threat Detection: What the 9-Country Advisory Means for Your SOC”.
By the numbers:
- It can take up to 18 months to discover a cyber security incident, according to Axoflow.
- Some malware dwells on the network 70 to 200 days before causing overt harm, according to Axoflow.
Key questions
Q: Why does log retention matter if the SOC already has a SIEM?
A: A SIEM cannot analyse telemetry that has already been deleted, tiered away incorrectly, or overwritten before discovery.
Q: What are the signs that alert investigation is failing in a SOC?
A: Common signs include a large share of alerts going uninvestigated, analysts spending too much time on benign events, delayed response times, and recurring burnout.
Q: What breaks when event logs are not structured and time-synchronised?
A: Correlation breaks first.
Practitioner guidance
- Standardize log schemas across priority sources Map critical systems to a single structured format, preserve stable field names, and remove source-specific drift before forwarding to analytics.
- Enforce UTC and synchronized time sources Use UTC everywhere, apply ISO 8601 timestamps, and validate one-directional time sync so investigations can reconstruct sequence accurately.
- Prioritize identity and control-plane logs first Collect authentication, permission change, admin configuration, and command execution telemetry before expanding to lower-value sources.
Bottom line: Structured logging is a detection requirement, not an administrative preference, because correlation fails when schemas and timestamps are inconsistent.
Glossary terms: Structured Logs, Detection Retention Gap, Telemetry integrity, Tamper-Resistant Logs
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
21/08/2026 5:04 pm
The real bottleneck is the data layer, not the SIEM. Detection platforms can only reason over what they receive, and log pipelines that distort schemas, timestamps, or field completeness degrade the entire SOC stack. That makes logging governance a prerequisite for detection quality, not a separate housekeeping task. Practitioners should treat telemetry fidelity as an operational control.
A question worth separating out:
Q: How should security teams harden centralized logging against tampering?
A: They should segment the log store, restrict delete and modify rights to a very small set of justified roles, and protect records in transit and at rest. The goal is to make evidence loss harder than maintaining the compromise, so response teams retain trustworthy telemetry.
👉 Read our full editorial: ASD ACSC logging guidance shows the data layer is the SOC bottleneck
This post was modified 3 days ago by NHI Mgmt Group