DefendArm SecurityDefendArm SecurityKnow your risks. Protect what matters.
Self-assessment

Security logging coverage

Could you reconstruct a compromise from the records you collect? Review evidence from a real query or controlled test, rather than a dashboard's connected status.

LoggingTelemetry

0 of 6 answered

1. Can you trace a test user's sign-in and administrative activity across your critical services?

Select an identity provider and two critical services. Confirm the actor, time, action, and target.

2. Would someone notice if a critical log source stopped sending events?

Check the alert for a missing or delayed source, its owner, and the last test.

3. Do your logs capture administrative changes and data access where needed?

Check actual events, enabled audit categories, license limits, and privacy constraints.

4. Can you retrieve logs from the oldest period your business says it needs?

Use a dated query or archive retrieval. Record retrieval time and any missing fields.

5. Can a compromised production administrator erase every copy of the audit trail?

Review delete permissions, storage separation, and alerts on logging changes.

6. Has a detection led an analyst to the records needed to make a decision?

Use a safe simulation and its alert, investigation query, and analyst response.

How to read the score

Use the gaps to plan the next test.

This self-review is not an audit, certification, or estimate of breach probability. Each answer earns 0, 2, or 4 points; unknown answers earn no points and are counted separately. The indicator gives equal weight to each question. Critical gaps are flagged separately so other answers cannot hide them.

View all assessmentsOpen the assessment index
Current stateScore against how the environment works today

Answer for the state you can prove now, not the state you plan to have after a future project lands.

InterpretationResolve unknowns and critical gaps first

Missing evidence is a reason to investigate. Assign an owner to each action, agree a test, and record the result before changing the answer.

Follow-throughRetest after the control changes land

The point of the assessment is to give you a before-and-after view that shows whether the next round of work actually improved the risk.