Getting started with logging
To improve your detection, it makes sense to set up a SIEM system for event collection so that you have all event logs in one place, allowing you to hunt and even build automated alerting.
There are many options if you want to choose a SIEM system – for every budget and scenario. Over the years, I have seen many different SIEM systems – and each one just fitted perfectly for each organization.
The most popular SIEM systems that I have seen out in the wild were Splunk, Azure Sentinel, ArcSight, qRadar, and the “ELK stack” (Elastic, LogStash, and Kibana), just to mention a few. I also saw and used Windows Event Forwarding (WEF) to realize event log monitoring.
Of course, it is also possible to analyze events on a local machine, but it is not practical – depending on the configuration, if the maximum log size is reached, old events are deleted, and you cannot easily correlate them with logs from another system.
...
