You Cannot Investigate What You Did Not Log

Every incident investigation eventually comes down to one question: what does the evidence show? Too often the honest answer is that the evidence was never collected. Across the intrusions of early 2025, from edge-device persistence to ransomware dwell time, the organizations that could scope and contain quickly were the ones that had already invested in logging and retention.

Visibility is a prerequisite, not a luxury

Detection and response both depend on data. Without logs, an intruder’s activity is invisible in real time and unreconstructable afterward. When an appliance or account is compromised, the difference between a two-day investigation and a two-month one is usually whether the relevant telemetry existed and survived.

What is worth capturing

• Identity events. Authentication successes and failures, multi-factor prompts, privilege changes, and new account creation.
• Endpoint activity. Process execution and command lines to reconstruct what ran.
• Network and edge. Firewall, VPN, and appliance logs, which are frequently the first thing an intruder touches.
• Cloud audit trails. Control-plane activity that records who did what in your tenants.

Retention and integrity matter

Logs that roll over after a few days are of little use when dwell times stretch into weeks or months. Retain important sources long enough to cover realistic attacker timelines, and forward events to a central store the attacker cannot easily reach.

Takeaway

Decide what you must be able to answer after a breach, then make sure the logs to answer it exist, are retained across realistic dwell times, and are stored where an attacker cannot erase them. Visibility built in advance is what turns an incident into a manageable event.