LOG-3 Centralized Logging

What is LOG-3 Centralized Logging Control about?

Centralized logging is a vital part of enterprise monitoring. Utilize a centralized monitoring tool to collect, analyze, predict, and report on system issues, such as performance issues.

Available tools in the marketplace

The following listing is “crowdsourced” from our customer base or from external research. TrustCloud does not personally recommend any of the tools below, as we haven’t used them.

Logging Tools

Zabbix

DataDog

ManageEngine

Available templates

TrustCloud has a curated list of templates, internally or externally sourced, to help you get started. Click on the link for a downloadable version:

• N/A: no template recommendation

Control implementation

Note: This control is 100% automated by TrustCloud. Connect your system to enjoy the benefits of automation. 

For a manual implementation:

Install a centralized logging tool that captures logs from various systems. Ensure the following are configured:

1. Enable a threshold for alert notifications (map the type of events to be notified about and the threshold to cross for notifications).
2. Set up an alert notification (ensure the alert is sent to a team for quick response and review).
3. Restrict access to the log.

What evidence do auditors look for?

Most auditors, at a minimum, are looking for the below-suggested action:

1. Provide a screenshot of the centralized tool dashboard showing the various systems connected to it and feeding it logs.
2. Provide a screenshot of the alert notification threshold.
3. Provide a screenshot of the alert notification.

Evidence example

For the suggested action, an example is provided below:

1. Provide a screenshot of the centralized tool dashboard showing the various systems connected to it and feeding it logs.
   The following screenshot shows the dashboard and the various events being tracked.
   
2. Provide a screenshot of the alert notification threshold.
   The following screenshot shows the alert notification configuration, demonstrating who will be alerted.
   
   
3. Provide a screenshot of the alert notification.
   The following screenshot shows an alert notification.