Collect Logs Sample Clauses

Collect Logs. Objective To gather security relevant logs in a central location for analysis, and forensics. Activities • Set up a central log server • Set up infrastructure to collect logs from different parts of the system • Collect security logs of critical systems, including: o Firewalls o Operating systems logs of critical servers o Application logs of critical servers Besides alerts from sensors, many activities require logs generated by hosts in the system. Almost any host will generate log events that are useful in identifying and analyzing security incidents. The risk is rather being flooded in so much events that the systems and processes cannot handle them. Security operations teams should have a conscious strategy and process to collect logs. Generally, it is recommended to start collecting logs based on certain use cases. If the security operations team wants to detect failed login attempts on routers, they start collecting router access logs. Logs may be collected in bulk for compliance reasons or to support big data inspired analysis tools. In most cases, more logs will be collected over time. So, the log management process for integrating more new log sources. Often this requires collaboration with the departments maintaining the hosts. Getting data from substations or other field locations, may also require support from telecom depart- ments. Making sure the time is synchronized on the logs sources is important to get usable data. In many cases, time synchronization is however already implemented for grid monitoring and control.