Telemetry coverage should map to detection questions
Collect data because it answers a question you need answered, not because it is available.
Working backwards from the behaviours you care about produces a much smaller and more useful set than collecting everything a vendor can emit. It also exposes the gaps: there are usually one or two questions you cannot answer at all, and those are more important than another terabyte of what you already have.
More on Logging and telemetry
- A log records an observation, not objective truthThe shadow, not the thing
- Central logging reduces local erasure riskIt left before you got there
- Verbose logging can leak secretsEverything, including that
- Retention determines how far back you can investigateThe line only goes back so far
- Parsing errors can silently break detectionsSilence is not the same as clear
- High-volume logs can hide high-value eventsBuried by the ordinary