An organization might need a large number of logs to record all the activity on its systems, networks, and applications. The four main types of logs that you need to keep to support security auditing include the following:
Event logs—General operating system and application software events
Access logs—Access requests to resources
Security logs—Security-related events
Audit logs—Defined events that provide additional input to audit activities
As shown in FIGURE 10-3, you should record all suspicious activity, errors, unauthorized access attempts, and access to sensitive information. As a result, you will not only track incidents, but you will also keep users accountable for their activities.
FIGURE 10-3 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month, and much more.
