Logging Coverage Matrix | DefendArm Security

Preview before download

Map logs to investigation questions before buying more storage

The matrix helps security, platform, and finance teams decide which records need hot search, long-term retention, normalization, and ownership.

Sample decisions

Start with identity, administration, access, movement, and recovery questions investigators must answer.
Separate logs used for detection from evidence retained for reconstruction, audit, and legal support.
Assign owners for collection, retention cost, query readiness, and archive restore.

Common mistakes

Keeping high-volume infrastructure logs while missing identity and SaaS administrative events.
Using one retention number for every source instead of tiering by forensic value.
Discovering during an incident that archived records cannot be restored into a query workflow.

What is inside

DefendArm Logging Coverage Matrix

Download a logging coverage matrix for AWS, Azure, SaaS, endpoint, identity, and network telemetry.

Fillable PDF. Reviewed 2026-09-21. Includes practical guidance and reusable review records.

Identity: authentication, MFA events, admin role changes, risky sign-ins, federation changes.
Cloud: audit trails, control plane actions, storage access, network flow, key management, workload logs.
SaaS: admin actions, sharing changes, mailbox rules, OAuth grants, external access.
Endpoint: process activity, isolation state, malware detections, EDR alerts, local account changes.
Network: DNS, proxy, VPN, firewall, segmentation events, ingress and egress anomalies.
Retention: define hot search, warm investigation, and deep archive requirements separately.

Questions and answers

Who should use the Logging Coverage Matrix?

This resource is built for Security engineers, cloud teams, IT leaders who need a clear way to turn security guidance into owners, evidence, and next actions.

What should a team prepare before using it?

Prepare current system owners, relevant policies, available logs or configuration evidence, and any known exceptions that affect the control area.

When should this turn into a deeper review?

Bring in the relevant specialist when the work exposes missing evidence, unclear authority, or controls your team cannot validate. Keep the unresolved issue, owner, and next decision recorded.