Matrix

Logging Coverage Matrix

A matrix for identifying which logs support detection, investigation, retention, and compliance needs.

LoggingTelemetrySIEM

Logging Coverage Matrix visual for DefendArm Security guidance

Preview before download

Map logs to investigation questions before buying more storage

The matrix helps security, platform, and finance teams decide which records need hot search, long-term retention, normalization, and ownership.

Sample decisions

Start with identity, administration, access, movement, and recovery questions investigators must answer.
Separate logs used for detection from evidence retained for reconstruction, audit, and legal support.
Assign owners for collection, retention cost, query readiness, and archive restore.

Common mistakes

Keeping high-volume infrastructure logs while missing identity and SaaS administrative events.
Using one retention number for every source instead of tiering by forensic value.
Discovering during an incident that archived records cannot be restored into a query workflow.

What is inside

DefendArm Logging Coverage Matrix

Download a logging coverage matrix for AWS, Azure, SaaS, endpoint, identity, and network telemetry.

Identity: authentication, MFA events, admin role changes, risky sign-ins, federation changes.
Cloud: audit trails, control plane actions, storage access, network flow, key management, workload logs.
SaaS: admin actions, sharing changes, mailbox rules, OAuth grants, external access.
Endpoint: process activity, isolation state, malware detections, EDR alerts, local account changes.

Questions teams ask

Practical questions before you decide.

Who should use the Logging Coverage Matrix?

This resource is built for Security engineers, cloud teams, IT leaders who need a practical way to turn security guidance into owners, evidence, and next actions.

What should a team prepare before using it?

Prepare current system owners, relevant policies, available logs or configuration evidence, and any known exceptions that affect the control area.

When should this turn into a deeper review?

Use a deeper review when the checklist exposes unclear ownership, missing evidence, privileged access risk, recovery uncertainty, or controls that cannot be validated.