List the investigation questions the team must answer before collecting more telemetry.
Cornerstone guide
Logging and Telemetry Guide
A guide for deciding which logs matter, who owns them, how long to retain them, and how investigators can use them.
Guide method
Use this as an owner-and-evidence plan.
Logging and telemetry guide for detection, investigation, retention, and forensic evidence quality.