Logging & Alerting Readiness Checklist

System Active

Verify you have necessary permissions.

Schedule time for this activity.

System Active

**Identity Provider**: Capture all login attempts (success/fail), MFA challenges, and admin changes (Okta/AzureAD).

**Cloud Trail/Audit**: Enable CloudTrail (AWS) or Audit Logs (GCP/Azure) for all regions, including global services.

**Endpoint**: Ingest EDR/Antivirus detection logs and process execution logs from critical servers.

**Network**: Capture firewall deny logs and VPN connection logs.

**Centralization**: Ship logs to a central SIEM or immutable bucket (S3 Object Lock) within 5 minutes of generation.

**Retention**: Configure retention to meet compliance (e.g., 90 days hot, 1 year cold).

**NTP Sync**: Verify all log sources are synced to a stratum-1 NTP source to ensure timestamp correlation.

**Critical Alerts**: Alert on: Root account login, Security Group changes (0.0.0.0/0), and Mass deletion events.

**Health Check**: Alert if log ingestion drops by > 50% (indicates broken agent or attacker disabling logs).

System Active

Confirm all items are marked.

Sign off on the log.

01 // EXECUTION_SEQUENCE