What Logs Do You Need for a Cyber Investigation?

When you are trying to work out what an attacker did, logs are your memory. And the cruel irony of cyber incidents is that the moment you most need them is often the moment you discover they were never being kept, or rolled off three days ago. A log you did not record is a question you can never answer.

This guide sets out which logs a UK SME should keep, why, and for how long, so that if an incident happens you can actually investigate it rather than guess. It is a companion to our full cyber incident response plan guide.

Why logs matter so much

During an incident, logs let you answer the questions that decide everything else: how did the attacker get in, what did they touch, are they still here, and has any data left the building? Without logs you are working from assumption, which means over-reacting in some places and missing the real damage in others. Logs also matter afterwards, for your insurer, for any regulatory questions, and for learning the genuine lesson. Good logging turns “we think” into “we know”.

The logs a UK SME should keep

The Microsoft 365 gap to close today

The most common logging gap we find is Microsoft 365 audit logging. Discovering after a mailbox compromise that unified audit logging was switched off, or that your licence only retained logs for a short period, is a genuinely bad day, because the evidence of what the attacker did simply does not exist. Check now that unified audit logging is enabled and that your retention is long enough to be useful. This one check has saved more investigations than any tool.

How long to keep them

There is no single legal number that fits every business, so match retention to how long an incident might go unnoticed and how long you might need the evidence afterwards. As a practical rule of thumb for an SME, aim to keep the key logs, especially identity, Microsoft 365 audit, firewall and endpoint, for several months rather than days. Extending default retention is usually a small change with a large payoff. If a log rolls off after a week, it protects you only against incidents you spot within a week, and many are not.

Make sure you can actually reach them

Two practical points people forget. First, know where each log lives and who can get to it, before an incident, not during one. Second, protect the logs themselves. Attackers sometimes try to clear logs to cover their tracks, so where you can, send important logs somewhere the attacker cannot easily reach or delete. During an incident, export the logs you need early, before they roll off or are tampered with, and record what you exported in your evidence register.

Frequently asked questions

Related reading: the full Cyber Incident Response Plan guide, how to preserve evidence after a cyber attack, and the free Cyber Incident Response Toolkit.