Log management

Collecting, storing, protecting and reviewing the activity records that systems, applications and devices generate, so problems and security incidents can be detected and investigated.

Almost every system records logs: sign-ins, failed passwords, file changes, firewall connections, email rules and administrator actions. Log management brings these records together in one place, keeps them for a defined period and makes them searchable. More advanced setups feed logs into a SIEM, which analyzes them for signs of attack.

Without logs, it can be impossible to answer basic questions after an incident, such as how an attacker got in, what they accessed and whether personal information was exposed. Those answers matter for deciding whether to notify Alberta's Information and Privacy Commissioner and affected individuals, and for insurance claims. Many cloud services keep only a limited amount of log history by default, and some detailed logs depend on your licence level.

Practical tip: check how long your key systems, especially Microsoft 365 or Google Workspace, firewalls and servers, keep their logs, and extend retention where possible. Make sure logs are stored somewhere an attacker cannot easily delete them, and that someone actually reviews important alerts.