Security Logging for Mid-Market Companies: What to Log, How Long to Keep It, and Who Watches It

Security Logging for Mid-Market Companies: What to Log, How Long to Keep It, and Who Watches It

2026-10-25

Takeaway: Most mid-market companies already generate the logs they’d need to investigate a breach. The trouble is that nobody chose which ones matter, the defaults delete them too soon, and nobody looks at them until it’s too late. Pick your high-value sources, keep them long enough to be useful, store them where an attacker can’t quietly erase them, and give one person the job of watching.

Quick definition: a log is the running record a system keeps of who did what and when, such as a sign-in, a password reset, a firewall connection, or someone opening a mailbox. Logs don’t stop attacks. They tell you what happened, which is the first thing your insurer, your lawyer, and your customers will ask.

The lesson from a premium log

In 2023, a hacking group Microsoft calls Storm-0558 got into Microsoft Exchange Online mailboxes at 22 organizations, including the U.S. State Department. According to the Cyber Safety Review Board’s report (March 20, 2024), State was the first victim to notice. Its security team had built a custom alert on a log called MailItemsAccessed, which records access to mailboxes. State could only see that log because it paid for Microsoft’s premium audit tier. During its access, the group downloaded roughly 60,000 emails from the State Department alone.

Two things changed afterward. Microsoft announced on July 19, 2023 that standard-tier customers would get detailed email-access logs and more than 30 other previously premium log types at no added cost, with rollout starting that September. And the lesson stuck: a log only helps if it exists, you can reach it, and someone has decided what to look for in it.

Step 1: Write a one-page logging policy

The joint guidance Best Practices for Event Logging and Threat Detection (August 21, 2024), led by Australia’s ASD with CISA, the FBI, the NSA and other partners, starts with an enterprise-approved logging policy. For a mid-market company, that’s one page answering four questions: what we log, where it goes, how long we keep it, and who reviews it.

Step 2: Start with the sources attackers touch first

The guidance gives a priority list. Translated for a typical mid-market company, start here:

  • Identity: sign-ins, MFA changes, new admin accounts, and role changes in Microsoft Entra ID, Google Workspace, or Active Directory.
  • Email and files: the Microsoft 365 or Google Workspace audit log, including mailbox access.
  • The network edge: firewalls, VPNs, and any remote-access tool.
  • Critical systems and data: your ERP, finance system, and file servers holding customer data.
  • Admin workstations and your security tools: the endpoint protection console and anything your IT provider uses to manage machines.

Lower on the list come user computers, DNS, web proxies, and older systems. Collect them when you can, but don’t let them delay the top five.

Step 3: Check what is actually turned on

Don’t assume. In Microsoft 365, the Audit (Standard) tier is on by default for eligible subscriptions and keeps records for 180 days (raised from 90 days for logs created on or after October 17, 2023). Microsoft’s retention policy documentation says one-year default retention for Exchange, SharePoint, OneDrive, and Entra records applies only to users with E5-level licenses or certain add-ons. On firewalls and servers, check storage as well as settings: the ASD-led guidance warns that many systems overwrite old logs when their storage allocation runs out.

Step 4: Set retention by risk, not by default

The guidance is blunt: “Default log retention periods are often insufficient.” It notes that discovering an incident can take up to 18 months and that some malware sits on a network for 70 to 200 days before causing visible harm.

For a reference point, look at the U.S. federal rule. OMB Memorandum M-26-14 (May 22, 2026) requires federal agencies to keep logs searchable for at least 6 months and retrievable for a year. It replaced a 2021 memo, and OMB said some of the old requirements, such as keeping vast quantities of log data without clear utility, proved “neither operationally feasible nor cost-effective for most agencies.” That rule doesn’t bind private companies, but “6 months searchable, 12 months retrievable” is a sensible floor for your most important logs. Then check whether your regulators, customer contracts, or cyber insurer require more.

Step 5: Centralize it and protect it

Send your priority logs to one place, whether that’s a security information and event management (SIEM) tool, a managed detection provider, or cloud storage your IT team controls. Restrict who can delete or change them, so an intruder with stolen admin rights can’t cover their tracks. Sync every system’s clock to the same trusted time source; the guidance prefers Coordinated Universal Time (UTC) so timestamps line up across systems during an investigation.

Step 6: Name the person who looks

State’s alert worked because someone wrote a rule and someone investigated it, even though that alert had produced false alarms before. You don’t need a 24/7 operations center to apply that. Pick five to ten alerts that matter (a new global admin, MFA removed from an executive, mail forwarding to an outside address, a sign-in from an unexpected country) and give each one an owner and a response time.

Step 7: Test it before you need it

At your next incident response tabletop, ask three questions and time the answers. Who signed in to the CFO’s mailbox last Tuesday? What did our firewall see from that IP address? Can we prove nobody deleted those records? If the answer is “we’d have to call the vendor,” you’ve found your gap.

The bottom line

Logging isn’t glamorous, and buying a tool won’t finish the job. The work is deciding what matters, paying for the right retention, and making sure someone reads the results. Yellow Coop’s CISO work includes a written incident response plan with a leadership tabletop exercise and a control gap list for cyber insurance applications, and a fractional engagement can own the security program outright. Let’s talk.

Sources