See
the
signal.

01# =============================================================================
02# Log source inventory — template
03#
04# Companion to:
05#   https://entropywatch.dev/articles/which-logs-do-you-actually-have/
06# License: CC BY 4.0 — ENTROPY//WATCH
07# Template version: 2026-10-17
08#
09# HOW TO USE
10#   1. Write your questions first (section `questions`). Every source you list
11#      should answer at least one of them; every question should have a source.
12#   2. One entry per SOURCE TYPE, not per host ("Windows domain controllers",
13#      not "DC01", "DC02"). List hosts only where coverage differs.
14#   3. Fill a field only after you have checked it on a real system. Unknown is
15#      a valid answer: write `unknown`, not a guess.
16#   4. Copy every gap you find into `gaps` and rank it.
17#
18# BEFORE YOU USE
19#   - ADAPT `questions` to your environment and threat model.
20#   - ADAPT `retention_target_days` per source: how far back YOUR incidents need
21#     to look, plus any legal or contractual requirement. Write down why.
22#   - DELETE the example entries (marked `example: true`) once you have your own.
23#     Every hostname, domain and IP below is a documentation placeholder.
24#   - Treat the finished file as sensitive: it is a map of what you can and
25#     cannot see. Do not publish your filled-in copy.
26# =============================================================================
27 
28as_of: YYYY-MM-DD          # date of the last full review
29owner: ""                  # person or team who keeps this file current
30review_every: quarterly    # and after any SIEM, agent or audit-policy change
31 
32# -----------------------------------------------------------------------------
33# 1. Questions an investigation must be able to answer
34#    Start here. Sources exist to answer questions, not the other way round.
35# -----------------------------------------------------------------------------
36questions:
37  - id: Q1
38    ask: "Who logged on where, when, and how (interactive, network, remote)?"
39    typical_sources: [domain controllers, Windows Security on members, Entra ID sign-ins, VPN, Linux auth]
40  - id: Q2
41    ask: "What ran on this machine, with which command line, started by what?"
42    typical_sources: [Windows Security 4688 with command line, Sysmon, EDR, Linux auditd]
43  - id: Q3
44    ask: "What did this machine talk to outside the network?"
45    typical_sources: [firewall allow + deny, DNS queries, web proxy, EDR network events]
46  - id: Q4
47    ask: "What changed in identity and privileges (accounts, groups, roles, MFA)?"
48    typical_sources: [domain controllers, Entra ID audit log, cloud control-plane logs]
49  - id: Q5
50    ask: "What was read, sent or shared from mail and SaaS?"
51    typical_sources: [Microsoft 365 unified audit log, mailbox audit, SaaS admin logs]
52  - id: Q6
53    ask: "Who changed the infrastructure (cloud resources, servers, network devices)?"
54    typical_sources: [Azure Activity log, AWS CloudTrail, network device AAA/config logs, Linux sudo]
55 
56# -----------------------------------------------------------------------------
57# 2. Sources — one entry per source type
58#
59# Field reference
60#   name                   what the source is
61#   category               identity | endpoint | server | network | email_saas | cloud | application
62#   answers                question ids from section 1
63#   systems                scope: how many systems, which are NOT covered
64#   records                what is actually enabled (audit subcategories, event types)
65#   local_retention        how far back the log on the system itself reaches TODAY
66#   central                where it is forwarded (null if nowhere)
67#   central_retention_days how long the central copy is kept, per storage tier
68#   retention_target_days  what you need (see BEFORE YOU USE)
69#   volume_gb_per_day      measured, not estimated; null until measured
70#   time                   time source and timezone of the timestamps
71#   collection             agent | syslog | API | none — and what alerts if it stops
72#   owner                  who can change the logging config
73#   verified               YYYY-MM-DD + how (command, query, test event)
74#   known_gaps             free text; copy each one into section 3
75# -----------------------------------------------------------------------------
76sources:
77 
78  - name: "Windows domain controllers — Security log"
79    example: true
80    category: identity
81    answers: [Q1, Q4]
82    systems: "all DCs in corp.example (DC01, DC02)"
83    records:
84      - "Advanced Audit Policy per `auditpol /get /category:*` (paste or attach output)"
85      - "Account Logon / Kerberos Authentication Service: Success and Failure"
86      - "Account Management / Security Group Management: Success"
87    local_retention: "unknown — check: Get-WinEvent -LogName Security -MaxEvents 1 -Oldest"
88    central: "SIEM via agent"
89    central_retention_days: { hot: null, archive: null }
90    retention_target_days: null
91    volume_gb_per_day: null
92    time: "domain time hierarchy (PDC emulator → external NTP); timestamps UTC in SIEM"
93    collection: "agent; alert if no events for 1 h: not yet"
94    owner: "AD team"
95    verified: "YYYY-MM-DD — test failed logon seen in SIEM as 4771 / 4625"
96    known_gaps:
97      - "Security log max size never changed from default — check `wevtutil gl Security`"
98 
99  - name: "Windows member servers and workstations — Security + Sysmon"
100    example: true
101    category: endpoint
102    answers: [Q1, Q2]
103    systems: "all domain-joined Windows; NOT covered: kiosk machines outside the domain"
104    records:
105      - "4688 process creation — is 'Include command line in process creation events' enabled?"
106      - "Sysmon config version: ''"
107    local_retention: unknown
108    central: "SIEM via agent"
109    central_retention_days: { hot: null, archive: null }
110    retention_target_days: null
111    volume_gb_per_day: null
112    time: "domain time; check skew on laptops off the network"
113    collection: "agent"
114    owner: "endpoint team"
115    verified: ""
116    known_gaps: []
117 
118  - name: "Linux servers — auth, sudo, auditd"
119    example: true
120    category: server
121    answers: [Q1, Q2, Q6]
122    systems: "SRV-APP01..SRV-APP12; NOT covered: appliances without agent support"
123    records:
124      - "auth / secure log via rsyslog or journald"
125      - "auditd rules per `auditctl -l` (empty output = no rules loaded)"
126    local_retention: "check logrotate config and `journalctl --disk-usage`"
127    central: "SIEM via syslog"
128    central_retention_days: { hot: null, archive: null }
129    retention_target_days: null
130    volume_gb_per_day: null
131    time: "chrony/NTP; check whether syslog timestamps carry a timezone"
132    collection: "syslog; a stopped forwarder is silent — nothing alerts"
133    owner: "platform team"
134    verified: ""
135    known_gaps: []
136 
137  - name: "Perimeter firewall"
138    example: true
139    category: network
140    answers: [Q3]
141    systems: "fw01 (HQ), fw02 (branch)"
142    records:
143      - "deny: yes"
144      - "allow: unknown — many policies log denies only"
145      - "NAT translations: unknown (needed to map public IP back to an internal host)"
146    local_retention: unknown
147    central: "SIEM via syslog from 192.0.2.10"
148    central_retention_days: { hot: null, archive: null }
149    retention_target_days: null
150    volume_gb_per_day: null
151    time: "check device NTP and the timezone in the syslog header"
152    collection: syslog
153    owner: "network team"
154    verified: ""
155    known_gaps: []
156 
157  - name: "DNS — internal resolvers"
158    example: true
159    category: network
160    answers: [Q3]
161    systems: "Windows DNS on DC01, DC02"
162    records:
163      - "query logging: off unless enabled (Windows DNS analytic/debug logging is off by default)"
164    local_retention: n/a
165    central: null
166    central_retention_days: { hot: null, archive: null }
167    retention_target_days: null
168    volume_gb_per_day: null
169    time: ""
170    collection: none
171    owner: "AD team"
172    verified: ""
173    known_gaps:
174      - "No record of which host resolved which domain"
175 
176  - name: "Microsoft 365 — unified audit log, Entra ID sign-in and audit logs"
177    example: true
178    category: email_saas
179    answers: [Q1, Q4, Q5]
180    systems: "tenant contoso.example"
181    records:
182      - "unified audit log: on? (check in the Purview portal)"
183      - "sign-in and audit logs exported to SIEM: which categories?"
184    local_retention: "depends on license — check current Microsoft documentation"
185    central: "SIEM via API connector"
186    central_retention_days: { hot: null, archive: null }
187    retention_target_days: null
188    volume_gb_per_day: null
189    time: "UTC"
190    collection: "API; connector health alert: unknown"
191    owner: "M365 admins"
192    verified: ""
193    known_gaps: []
194 
195# -----------------------------------------------------------------------------
196# 3. Gaps — ranked
197#    impact: which question goes unanswered, for which systems
198#    fix_cost: low (config change) | medium (new collection/storage) | high (new product or project)
199# -----------------------------------------------------------------------------
200gaps:
201  - id: G1
202    example: true
203    source: "Windows domain controllers — Security log"
204    question: Q1
205    finding: "Local Security log reaches back N hours on DC01 at Monday peak"
206    impact: "If forwarding stops, logon history older than N hours is lost"
207    fix: "Raise max log size; add an alert on forwarding silence"
208    fix_cost: low
209    owner: "AD team"
210    status: open        # open | planned | fixed | accepted
211    accepted_reason: ""
212 
213# -----------------------------------------------------------------------------
214# 4. Verification commands (read-only)
215# -----------------------------------------------------------------------------
216checks:
217  windows:
218    - cmd: "auditpol /get /category:*"
219      shows: "which audit subcategories are enabled (run elevated)"
220    - cmd: "wevtutil gl Security"
221      shows: "maxSize and retention of the Security log"
222    - cmd: "Get-WinEvent -LogName Security -MaxEvents 1 -Oldest | Select-Object TimeCreated"
223      shows: "how far back the local Security log reaches right now"
224  linux:
225    - cmd: "auditctl -s"
226      shows: "whether auditd is enabled and how many events it lost"
227    - cmd: "auditctl -l"
228      shows: "loaded audit rules; 'No rules' means nothing beyond defaults"
229    - cmd: "journalctl --disk-usage"
230      shows: "space used by the journal"
231    - cmd: "journalctl -o short-iso | head -n 1"
232      shows: "oldest journal entry still on disk"
233  siem_microsoft_sentinel:
234    - query: "union withsource=SourceTable * | where TimeGenerated > ago(7d) | summarize LastEvent = max(TimeGenerated) by SourceTable | sort by LastEvent asc"
235      shows: "tables that went quiet first (expensive on big workspaces: narrow the time range)"
236  siem_wazuh:
237    - cmd: "/var/ossec/bin/agent_control -l"
238      shows: "agents and their status (Active, Disconnected, Never connected)"

01# =============================================================================
02# SIEM selection matrix — Wazuh, Elastic Security, Microsoft Sentinel,
03# IBM QRadar SIEM, Splunk Enterprise Security
04#
05# Companion to:
06#   https://entropywatch.dev/articles/choosing-a-siem-by-what-you-run/
07#   https://entropywatch.dev/articles/siem-operating-cost-in-people/
08# License: CC BY 4.0 — ENTROPY//WATCH
09# Facts as of: 2026-10-17 (vendor documentation; every fact carries its source)
10#
11# BEFORE YOU USE
12#   - This is a reading of vendor documentation, not a benchmark. Re-check every
13#     linked source on the day you decide: prices, tiers and grants change often.
14#   - ADAPT size_tiers to your security team's capacity, not company headcount.
15#   - ADAPT the filters to where your highest-value logs live (identity,
16#     endpoints, perimeter), not where most of your servers are.
17#   - Prices appear only where the vendor publishes them; "not published" means
18#     ask for a quote.
19# =============================================================================
20 
21as_of: 2026-10-17
22 
23measure_first:
24  - metric: daily_volume_per_source
25    unit: "GB/day (Sentinel, Elastic Serverless, Splunk ingest), EPS/FPM (QRadar), alerts/s + agents (Wazuh)"
26    how: "Measure per source type (DCs or Entra sign-ins, firewall, proxy, endpoints, cloud audit) for at least one week."
27  - metric: engineering_hours_per_week
28    how: "Hours someone can really spend on parsers, tuning, upgrades and capacity — not headcount."
29 
30size_tiers:
31  small:
32    definition: "No dedicated security staff; one IT generalist or security as part of an IT role."
33    microsoft_centric: Microsoft Sentinel
34    on_prem_or_zero_budget: Wazuh (single node)
35    linux_or_multi_cloud_with_search_skills: Elastic Security (Serverless Essentials)
36    avoid:
37      - "Splunk Free as a SIEM: no alerting, no users or roles, 500 MB/day."
38      - "Splunk ES: documented minimum 16 physical cores / 32 GB RAM per search head and indexer."
39      - "QRadar Community Edition in production: 3-month license, 100 EPS / 5,000 FPM."
40  mid_size:
41    definition: "Small security team, or one or two people plus an MSSP; hybrid infrastructure."
42    microsoft_heavy_hybrid: "Microsoft Sentinel with analytics tier for primary data, data lake tier for verbose logs"
43    mixed_or_non_microsoft: "Elastic Security (check which paid tier you can buy), or Wazuh as endpoint layer feeding a SIEM"
44    splunk_or_qradar_when: "Already owned, staff know SPL/AQL, or an MSSP runs it"
45  large:
46    definition: "24/7 SOC, detection engineers, platform/data team; hundreds of GB to TB per day."
47    deciding_questions:
48      - "Must data stay on-premises or in a specific jurisdiction?"
49      - "Which estate dominates: Microsoft, Cisco/Splunk, IBM, or mixed?"
50      - "Which query language does the current team already know: KQL, SPL, AQL, ES|QL?"
51    candidates:
52      - Splunk Enterprise Security
53      - Microsoft Sentinel
54      - IBM QRadar SIEM (existing estates, network flows, on-prem appliances)
55      - Elastic Security (especially where Elasticsearch already runs)
56      - Wazuh (endpoint/compliance layer; primary SIEM only with strong engineering)
57 
58infrastructure_filters:
59  microsoft_365_entra_azure:
60    favors: Microsoft Sentinel
61    why: "Free data sources (Azure Activity, Office 365 audit, Defender alerts); M365 E5/A5/F5/G5/E7 grant up to 5 MB/user/day."
62  air_gapped_or_data_must_stay_on_prem:
63    excludes: [Microsoft Sentinel, Elastic Serverless, Splunk Cloud Platform]
64    remaining: [Wazuh, Elastic self-managed, IBM QRadar SIEM, Splunk Enterprise]
65  network_flows_first_class:
66    favors: IBM QRadar SIEM
67    why: "Licenses and processes flows (FPM) separately from events (EPS); dedicated Flow Collector/Processor."
68  linux_containers_multi_cloud:
69    neutral_options: [Wazuh, Elastic Security, Splunk Enterprise Security]
70 
71platforms:
72  wazuh:
73    current_version: "4.14.x"
74    license: "GPLv2 and Apache 2.0"
75    deployment: "Self-managed (server, indexer, dashboard, agents) or Wazuh Cloud"
76    detection_language: "XML rules and decoders; custom rule IDs 100000-120000"
77    sizing_single_host_90_days:
78      - { agents: "1-25", cpu: "4 vCPU", ram: "8 GiB", storage: "50 GB" }
79      - { agents: "26-50", cpu: "8 vCPU", ram: "8 GiB", storage: "100 GB" }
80      - { agents: "51-100", cpu: "8 vCPU", ram: "8 GiB", storage: "200 GB" }
81    indexer_node: { min_ram: "4 GB", min_cpu: 2, rec_ram: "16 GB", rec_cpu: 8 }
82    beyond_100_agents: "Distributed deployment: server cluster behind a load balancer, multi-node indexer"
83    upgrades: "Server, indexer, dashboard must match to patch level; agents must not be newer than the server"
84    ops_effort: "Low at small scale; medium to high distributed"
85    sources:
86      - https://documentation.wazuh.com/current/quickstart.html
87      - https://documentation.wazuh.com/current/installation-guide/wazuh-indexer/index.html
88      - https://documentation.wazuh.com/current/user-manual/wazuh-server-cluster/index.html
89      - https://documentation.wazuh.com/current/user-manual/ruleset/rules/custom.html
90      - https://documentation.wazuh.com/current/upgrade-guide/compatibility-matrix/index.html
91      - https://documentation.wazuh.com/current/getting-started/use-cases/index.html
92 
93  elastic_security:
94    license: "Elastic License 2.0, SSPL 1.0, or AGPLv3 (AGPL option added 2024-08-29) for the free source"
95    deployment: "Self-managed, Elastic Cloud Hosted, Elastic Cloud Serverless"
96    detection_language: "KQL, EQL, ES|QL"
97    paid_feature_gates_self_managed:
98      - "Elastic Defend ransomware, memory threat, malicious behavior protection: Platinum or Enterprise"
99      - "Response actions and response console: Enterprise"
100      - "Alert suppression: Platinum or higher"
101      - "Alerting on ML anomaly detection: Platinum or Enterprise"
102      - "Searchable snapshots (frozen tier): Enterprise"
103      - "Platinum not available to new customers (per subscriptions page footnote)"
104    serverless_pricing_as_low_as:
105      essentials: { ingest_per_gb: "$0.09", retention_per_gb_month: "$0.017" }
106      complete: { ingest_per_gb: "$0.11", retention_per_gb_month: "$0.019" }
107      per_endpoint_fee: "None since 2026-03-23"
108    ops_effort: "Low infra on Serverless; medium to high self-managed"
109    sources:
110      - https://www.elastic.co/subscriptions
111      - https://www.elastic.co/pricing/serverless-security
112      - https://www.elastic.co/docs/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend
113      - https://www.elastic.co/guide/en/elasticsearch/reference/current/searchable-snapshots.html
114      - https://www.elastic.co/blog/elastic-security-detection-engineering
115      - https://www.businesswire.com/news/home/20240829537786/en
116 
117  microsoft_sentinel:
118    deployment: "SaaS on Azure; on-prem sources via Linux forwarder with Azure Monitor Agent (+ Azure Arc outside Azure)"
119    portal: "Azure portal support ends 2027-03-31; Defender portal only after that"
120    detection_language: KQL
121    billing:
122      analytics_tier: "Pay-as-you-go or commitment tiers from 100 GB/day; tier can be lowered every 31 days"
123      analytics_retention: "90 days included, extensible to 2 years"
124      data_lake_tier: "Per-GB ingestion, processing, storage (6:1 compression basis) and query meters"
125      free_trial: "First 10 GB/day free for 31 days"
126      free_sources: "Azure Activity, Office 365 audit (SharePoint, Exchange admin, Teams), Defender/Entra ID Protection alerts"
127      m365_grant: "Up to 5 MB/user/day of Microsoft 365 data for E5/A5/F5/G5 (and E7)"
128      extra_costs: "Logic Apps (automation), Azure Functions (some connectors)"
129    ops_effort: "Low infra; ongoing cost governance"
130    sources:
131      - https://learn.microsoft.com/en-us/azure/sentinel/billing
132      - https://learn.microsoft.com/en-us/azure/sentinel/log-plans
133      - https://learn.microsoft.com/en-us/azure/sentinel/connect-cef-syslog-ama
134      - https://azure.microsoft.com/en-us/pricing/offers/sentinel-microsoft-365-offer
135 
136  ibm_qradar_siem:
137    current_version: "7.6.0 (announced 2026-06-30)"
138    deployment: "On-premises hardware or virtual appliances; All-in-One or distributed (Console, Event/Flow Collectors and Processors, Data Nodes)"
139    licensing: "Usage model: EPS + FPM; Enterprise model: Managed Virtual Servers; subscription or perpetual"
140    detection_language: "Custom Rules Engine (rule wizard), AQL"
141    saas_status: "QRadar SaaS sold to Palo Alto Networks (closed 2024-09); QRadar on Cloud EOL 2026-04-14; on-prem not affected"
142    notes:
143      - "QRadar Incident Forensics not available in 7.6.x; stay on 7.5.0 UP15 if you use it"
144      - "Over-allocating EPS/FPM in License Pool Management can block Log/Network Activity tabs"
145      - "Community Edition: 3-month license, 100 EPS, 5,000 FPM"
146    ops_effort: "High; specialist skills"
147    sources:
148      - https://www.ibm.com/products/hosted-security-intelligence/pricing
149      - https://community.ibm.com/community/user/blogs/ashish-kothekar/2026/06/30/announcing-ibm-qradar-760-the-biggest-qradar-relea
150      - https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary
151      - https://investors.paloaltonetworks.com/news-releases/news-release-details/palo-alto-networksr-closes-acquisition-ibms-qradar-saas-assets
152      - https://www.ibm.com/support/pages/node/6964816
153      - https://www.ibm.com/community/101/qradar/ce/
154 
155  splunk_enterprise_security:
156    owner: "Cisco (acquisition completed 2024-03-18)"
157    current_version: "ES 8.x (8.4 GA 2026-02; 8.6 controlled availability 2026-07)"
158    deployment: "Splunk Enterprise (forwarders, indexers, search heads) or Splunk Cloud Platform"
159    minimum_hardware: "16 physical cores / 32 GB RAM per search head and per indexer (ES 8.x)"
160    detection_language: "SPL; data normalized to the Common Information Model"
161    pricing_models: "Ingest (GB/day), workload (SVC in Cloud, vCPU on-prem), activity-based (Cloud only); prices not published"
162    splunk_free: "500 MB/day, single instance, no alerting, no users or roles — not a SIEM"
163    upgrade_notes:
164      - "ES 8.4: finding-based detections created before 8.4 may need updates"
165      - "ES 8.x on Splunk Enterprise 10.x on-prem: install from the command line"
166    ops_effort: "High self-managed; dedicated administrator"
167    sources:
168      - https://help.splunk.com/en/splunk-enterprise-security-8/install/8.3/planning
169      - https://help.splunk.com/en/splunk-enterprise-security-8/release-notes-and-resources
170      - https://www.splunk.com/en_us/products/pricing/pricing-models.html
171      - https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.0/configure-splunk-licenses/about-splunk-free
172      - https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2024/m03/cisco-completes-acquisition-of-splunk.html
173 
174proof_of_concept:
175  candidates: 2
176  duration: "at least 2 weeks"
177  same_sources_into_both:
178    - "Domain controllers or Entra ID sign-ins"
179    - "Perimeter firewall"
180    - "Endpoint telemetry from a sample of machines"
181  measure:
182    - "Ingested GB/day per source"
183    - "Alerts/day before and after one tuning round"
184    - "Engineering hours per job: onboarding, tuning, platform upkeep"
185    - "Time to write and tune one identical detection in each platform"