A small company can collect millions of log events and still be unable to answer a simple question: which account changed the payment details? The problem is rarely a total absence of logs. More often, the useful records were never enabled, reached the wrong place, expired too soon, lacked a reliable timestamp, or sat in a platform nobody knew how to search.
Security logging for SMBs should begin with the decisions the business may have to make during a bad day. Decide which investigations matter, then collect enough evidence to support them. Storage volume is not the objective. A log earns its cost when somebody can use it to detect trouble, scope an incident, reconstruct an action or prove that an expected control worked.
CISA's August 2026 Logging Reference Architecture puts the same idea in blunt terms: design logging around necessary security outcomes and operational use, not around compliance or tool enablement alone. The document was written for US federal agencies. Its engineering logic is useful well beyond that audience; its federal requirements are not.
Start with the questions an investigation must answer
Before comparing SIEM products or retention tiers, write down ten to twenty questions that matter to the company. Use recent support cases, fraud concerns, known failure modes and the systems that hold sensitive or operationally important data.
A useful first set might include:
- Who signed in to an administrator, finance or email account, from where, with which device and authentication result?
- Who created a privileged account, changed a role, disabled multi-factor authentication or altered a security policy?
- Which endpoint executed a suspicious process, command or script, and under which user?
- Which mailbox rule, OAuth grant, API key or forwarding setting changed?
- Which application accessed or exported a sensitive record?
- Which public service received the request, what did it do, and which backend identity did it use?
- Which security control stopped an action, and which control failed to produce evidence?
These are investigation questions, not log-source names. Each one leads to a compact evidence map: events required, systems that generate them, fields needed, expected delay, owner and retention period. If a proposed data source cannot help answer a defined question, satisfy a real legal or contractual need, or operate a control, it belongs below the first collection tier.
The NIST SP 800-92 Revision 1 initial public draft takes an organisation-wide planning approach. It defines log management as generating, transmitting, storing, accessing and disposing of log data, and says the plan should be informed by the activities that will use logs for security and operational decisions. The draft is not a final standard, but that planning principle is sound: demand should shape collection.
Four outcomes that should not be collapsed into one
CISA separates continuous event monitoring, threat hunting, incident response and digital forensics. They share telemetry, but they are different jobs.
Continuous event monitoring
Continuous monitoring is routine observation for defined conditions. A rule may flag a new administrator, repeated failed sign-ins followed by success, endpoint protection being disabled, or an impossible combination of identity and network activity. It needs timely delivery, stable fields, known baselines and an owner for the alert. A noisy rule without a response path is expensive background radiation.
For an SMB, continuous does not have to mean that an employee watches a console every second. It does mean that the collection and detection path runs consistently, health failures are visible, and high-impact alerts reach a person or provider within an agreed window. Enclave Guard's MDR and SOC service is a relevant next step when the company needs that operating layer rather than another dashboard.
Threat hunting
Threat hunting starts with a hypothesis and searches across existing evidence. A hunter might ask whether a stolen session token was used after a legitimate login, or whether a remote-management tool appeared on endpoints where it is not approved. Hunting needs broader search and context than a fixed alert, and it benefits from history. It is periodic, analyst-led work; calling every saved search a hunt empties the term of meaning.
Incident response
Incident response uses logs to make decisions during a known or suspected incident: contain which account, isolate which host, notify whom, preserve what, and check whether the activity spread. Speed and retrievability matter. So do contact details, authority and a tested procedure. A perfectly normalized archive that takes two days to restore may be poor response evidence.
Digital forensics
Forensics aims to reconstruct and support defensible conclusions. It may require original records, provenance, integrity protection, consistent time, documented access and a longer chain of events. Most small firms will not maintain a full forensic laboratory. They should still preserve high-value original evidence and know how to hand it to a qualified investigator without overwriting or casually transforming it.
This distinction prevents two common purchasing mistakes. A detection platform is not automatically a forensic archive, and cheap cold storage is not a monitoring capability.
Pick sources by business value and attack path
Once the questions and outcomes are clear, rank sources. For many SMBs, identity comes first because cloud administration, email and remote access depend on it. Next are endpoints, email and collaboration platforms, public-facing services, firewalls or secure access services, cloud control planes, critical SaaS applications, and backup administration.
The exact order changes with the business. A manufacturer may prioritise remote access and production systems. A software company may need cloud audit trails, source control, CI/CD and secrets management. A professional-services firm may put email, document sharing and client-data access near the top.
For each source, capture:
- the investigation questions it supports;
- the event categories to enable;
- required fields, including actor, action, target, result, source, timestamp and correlation identifiers where available;
- expected delivery delay and acceptable loss;
- who owns the source and who can search it;
- retention, legal hold and deletion rules;
- collection cost, storage cost and query cost;
- how collection health will be tested.
CIS Control 8 is devoted to audit log management, which is a useful signal that logging is a managed control rather than a one-off connector project. For a small team, the process can fit on a few pages. It still needs an owner, review cadence and proof that priority sources are arriving.
Fidelity beats indiscriminate volume
A source is useful only if its events carry enough detail to distinguish actors and actions. Fidelity includes accurate timestamps, stable identifiers, success or failure, the affected object, source context and sufficient event detail. It also means preserving original semantics when normalizing records. Turning every vendor-specific event into a vague category may simplify a dashboard while destroying the detail an investigation needs.
Test fidelity with scenarios. Create a temporary admin account, change a safe policy in a test tenant, trigger a blocked sign-in, rotate a test API key, and confirm that the expected events arrive with the fields required by the evidence map. Then verify that clocks use a trusted time source and that time zones are handled consistently. Document what is absent. Missing evidence discovered during a tabletop exercise is cheaper than missing evidence discovered after fraud.
Collection pipelines also fail quietly. Licences change, APIs throttle, agents stop, certificates expire and vendors rename fields. Monitor source freshness, event volume and parser errors. Alert when a critical source goes silent, not only when it reports an attack.
Retention is a decision, not a universal number
OMB's May 2026 memorandum M-26-14 says that retaining vast quantities of logging data without clear utility had proved neither operationally feasible nor cost-effective for most US federal agencies. It replaced that approach with risk-based prioritisation for those agencies. Ordinary EU or Latin American SMBs are not bound by this US federal memorandum or CISA's agency deadlines and maturity requirements. They can borrow the engineering lesson: retain evidence according to purpose, risk and retrieval needs, not federal mandate.
There is no honest universal retention period. Start with the time between compromise and likely discovery, contractual or sector rules, incident-response needs, investigation history, storage economics and the sensitivity of the records. Keep frequently queried detection data in a searchable hot tier for the period operations actually use. Move selected evidence to a cheaper tier when later investigation justifies it. Preserve original high-value records where integrity matters. Delete data when its purpose and applicable obligations end.
Do not confuse cheap storage with cheap logging. Ingestion, normalization, indexing, cross-region transfer, long-range queries and analyst time can cost more than raw capacity. A useful budget model separates collection, searchable retention, archive, retrieval and people. Sample actual event rates before signing a volume commitment, then allow for growth and incident spikes.
Privacy belongs in the design
Logs can contain usernames, IP addresses, device identifiers, URLs, message metadata, customer references and sometimes content. Under the GDPR, personal data must be adequate, relevant and limited to what is necessary, and kept in identifiable form no longer than necessary for its purpose. That does not prohibit security logging. It rules out treating every available field and indefinite retention as harmless defaults.
For EU operations, document purpose and lawful basis with privacy counsel or the responsible adviser. Minimise fields before central collection where feasible; avoid passwords, tokens, full message bodies and sensitive payloads; restrict log access by role; encrypt data in transit and at rest; record administrative searches; define deletion and legal-hold paths; and assess transfers to providers or regions. LATAM companies need the same engineering discipline, applied to their own national law and contracts rather than assuming GDPR is the only rule.
Security and privacy are not opposing teams here. A focused dataset is easier to protect, cheaper to search and less damaging if the logging platform itself is compromised. Enclave Guard can help connect this work to infrastructure and compliance consulting without pretending that a technical design replaces legal advice.
A practical 30-day logging plan
During week one, choose the ten investigation questions and inventory where the answers could come from. Name an accountable owner and identify any provider dependencies.
In week two, connect the highest-value identity, endpoint, email and critical-service sources. Preserve native audit records where possible. Confirm time, actor, action, target and result fields with safe test events.
In week three, implement a small set of detections tied to response actions. Add collection-health checks. Define hot and archive retention by source, and estimate monthly cost from measured volume rather than a sales calculator alone.
In week four, run a tabletop exercise. Pick one plausible scenario, retrieve the evidence and time the work. Record which questions could not be answered, which permissions slowed the search and which records exposed unnecessary personal data. Use those findings for the next collection cycle.
The deliverable is not a wall of dashboards. It is a short logging plan, an evidence map, working collection for priority sources, tested searches, health monitoring and a backlog ordered by risk. If your team cannot retrieve and explain the evidence, talk to Enclave Guard before buying another year of storage.
This article provides general cybersecurity information, not legal advice. Retention, employee monitoring, access and disclosure rules depend on jurisdiction, sector, contracts and the data involved.
