Ghostdrive

News · Academy · November 12, 2026

Academy: what a small team should log, and for how long

You cannot investigate what you did not record. The minimum logging that US, UK and allied agencies recommend, and how to start for free.

DRIVE 369 DAO · 2 min read

Academy, organisations, lesson 11. When an incident happens, the first question is "what did they do?". Without logs the answer is a guess.

Why defaults fail

The joint guide from CISA, the NSA, the FBI and Australia's ASD, Best Practices for Event Logging and Threat Detection (August 2024), says that default log retention is often too short and that it can take a long time to identify an incident. Mandiant's median dwell time is 14 days, and some intrusions run for months, so a log that rolls over after a week may be gone before anyone looks.

The four themes of the guide

  1. A logging policy approved by the organisation: which events, how long they are kept, who watches them.
  2. Central collection, so that logs from many systems can be searched together.
  3. Secure storage and integrity, so that an intruder cannot erase the trail.
  4. A detection strategy that includes "living off the land": attackers using your own tools, which leaves fewer obvious traces.

A minimum for a small team

  • Sign-ins and failures for your identity provider, email and cloud.
  • Administrative actions: new users, role changes, new API keys and apps.
  • Web servers: access and error logs.
  • Firewalls and VPN: connections, especially to management interfaces.
  • Endpoints: process starts on servers.
  • Cloud audit logs, which are usually off or short by default. Switch them on.
  • Keep them somewhere separate from the systems they describe, with a clock that is synchronised.
  • Retention: keep security logs for months, not days. The guide gives no single number, so pick what your risk and your law require, and write it down.

How to start for free

The NCSC and CISA publish Logging Made Easy, open-source centralised logging for small organisations running Windows. NCSC's introduction to logging for security purposes says that, at the very least, a small organisation should have an effective logging system.

Then use it

Set a few alerts: a sign-in from a new country, a new administrator, a new API key, logging turned off, a large data transfer. Review them weekly. Logs nobody reads protect nothing.

How Ghostdrive approaches it

Every use of your memory by an AI leaves a signed receipt, the Crew gateway logs each call per client, and your vault keeps an access journal that syncs between your devices. For a company's servers, the list above is yours to run, and Ghostdrive does not collect your logs.

Academy: start here · Are you already breached? · Hunting after patching