Logs Exist. Nobody's Watching. That's the Gap.

Published by Anvexa Security Solutions.

Nearly every system you run already produces logs: servers, firewalls, cloud accounts, email and identity providers. The problem is that in most organisations nobody reviews them until after an incident, by which time the useful entries may have been overwritten.

A lean team doesn't need to build a full SIEM to fix this. Begin by centralising the sources that tell you the most: identity and sign-in logs, email, cloud admin activity and endpoints. Keep them long enough to be useful. CERT-In expects logs to be retained for 180 days.

Then decide what you actually want to be alerted on. A short list beats a long one: sign-ins from unusual countries, new admin accounts, MFA being disabled, or a large data download at 3 a.m. Five or six alerts that people trust are worth more than two hundred that everyone ignores.

The last part is the one teams skip: an escalation path. Who is alerted, who decides what to do, and who reports to the regulator if required? CERT-In asks for certain incidents to be reported within six hours, so that chain needs to be written down before you need it.

If you can't staff round-the-clock cover, an MDR provider can do the watching. Just make sure they understand your environment well enough to separate real threats from normal noise.