Logging and log retention

Logging and log retention cover the recording of security events (logons, privilege escalations, mailbox access, database queries) and how long those records stay available. Without logs, a post-incident investigation turns into an estimate. In June 2023, the US State Department spotted Storm-0558's access to Exchange Online mailboxes through an audit log that Microsoft then reserved for its top-tier licenses. The following month, Microsoft announced it would open that logging to more customers and raised default retention from 90 to 180 days. The application asks whether logs are centralized, in a security information and event management (SIEM) platform or with a detection provider, whether they cover endpoints, directory, email and cloud, and how long they are kept. Some standards set a floor: the Payment Card Industry Data Security Standard (PCI DSS) requires a year of audit log history, with three months immediately available. Attacker dwell time is often counted in weeks. If retention is shorter, the investigation cannot reach the entry point and the exfiltration question stays open. Cost follows: forensics runs longer, and notification goes out as a precaution to a wider population, because nobody can prove a database was not read. The underwriter rarely checks the logs themselves. He asks who reads them at night and on weekends, and whether an alert triggers action. A practitioner's caveat: many companies keep logs nobody uses, and an attacker who gets admin rights often starts by wiping them or killing the agent that ships them. A copy out of reach of the compromised directory counts for more, when the investigation starts, than long retention on the server under attack.