Hands-On Security in DevOps

Logging policy

The general objective of security monitoring is to understand the existing security posture of the data, the network, endpoint hosts, gateway, cloud services, web services, databases, applications, and security configurations. This monitoring can be done by various kinds of security tools, such as host IDS, network IDS/IPS, antivirus software, firewalls, and also security information and event management (SIEM). The security monitoring scenario will decide which logs should be collected, what should be monitored, and the focus of the threat visualization.

If the logs are collected too often, the information can be overwhelming and occupy too many resources, such as storage and network traffic. On the other hand, if the logs ...