Log Management
What is Log Management?
The process of collecting, aggregating, storing, and analysing log data from various sources across an IT environment. Log management supports security monitoring, compliance reporting, and incident investigation.
Terms that appear alongside log management
Each of these is named in at least one of the same controls as log management. The number is how many controls name both.
- audit 11 shared controls
- nist 9 shared controls
- integrity 8 shared controls
- log retention 6 shared controls
- security monitoring 5 shared controls
- incident response 5 shared controls
- authentication 5 shared controls
- audit log 5 shared controls
Frameworks that govern log management
What the standards actually require on log management
Requirements naming log management across 6 standards, quoted from the control text.
Establish a log management programme per NIST SP 800-92 Chapter 2 (Introduction to Computer Security Log Management) + Chapter 4 (Log Management Planning).
NISTSP92-1 · Log Management Programme, Policy, Roles, and Operational Runbooks →Keep a written process for audit logging that sets the enterprise's logging requirements and, at minimum, covers how logs are collected, reviewed and retained for enterprise assets. Review it yearly or after significant change.
cis-controls-v8-1::8.1 · Establish and Maintain an Audit Log Management Process →Set up and keep a process for managing audit logs that sets out what the enterprise needs to log and, as a minimum, how logs from enterprise assets are gathered, reviewed and kept.
CIS-8.1 · Establish and Maintain an Audit Log Management Process →Management uses logs to identify, track, analyse and resolve operational problems, records occurrences, anomalies, usage and activity across operating systems, applications, network devices and security systems, balances the volume collected against storage an...
ffiec-it-examination-handbook::AIO-VI.B.7 · VI.B.7 Log Management (Architecture, Infrastructure, and Operations) →Set and regularly review procedures for acquiring, monitoring and retaining logs, covering for example what is logged, scope (hardware, software, services monitored), access control to logs, monitoring method, tamper prevention, retention period and storage me...
japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.3.4.2-B · 2.3.4.2 Log management: basic actions →Aggregate security logs in Microsoft Sentinel or equivalent SIEM with documented detection rules and analyst workflows.
LT-5 · Centralize security log management and analysis →Questions people ask about log management
What is Log Management?
Why is Log Management important for compliance?
Which compliance frameworks address Log Management?
Where can I learn more about Log Management?
See how Log Management applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.