After most incidents, the hardest question is not what happened but when it started. Without logs, that question is unanswerable, which means you cannot scope the breach, cannot tell customers what was affected, and cannot meet notification obligations with any confidence.

Start with authentication

Successful and failed logins, MFA challenges, password changes, and new device registrations across your identity provider, email, and any production console. These answer the questions that matter most: when access began, from where, and whose credentials were used.

Then the changes that matter

  • Administrative actions: permission grants, role changes, new admin accounts.
  • Mailbox rule creation and mail forwarding changes.
  • Third-party application authorisations.
  • Deployments and configuration changes, with who triggered them.
  • Data exports and bulk downloads.

Retention beats sophistication

Intrusions are frequently discovered weeks or months after they began. Logs kept for seven days are of no use in that scenario. Extend retention to several months for the categories above, even if you retain less of everything else. Retention is usually a pricing or configuration decision rather than an engineering one.

Put logs where they cannot be deleted

An attacker with production access will clear traces if they can. Ship logs to a separate account or service with append-only or immutable storage and its own credentials. This is the difference between having an investigation and having a theory.

Alert on a small number of things

Alerting on everything produces noise that is ignored within a week. Start with four: new external mail forwarding rules, new administrative account or role grant, sign-in from an unexpected country, and failure of your backup job. Each is high signal and rare enough that people still read them a year later.

Check your existing tooling first

Most teams already own more logging capability than they use. Identity providers, cloud platforms, and productivity suites all include audit logging that is frequently switched off or set to minimum retention by default. Turning those on costs nothing and is the fastest available improvement.