How do we preserve logs before they are overwritten?
Export them as soon as an incident is suspected, before you change anything else. Many devices keep logs only for days or until a size limit: firewalls, VPN gateways, switches and some cloud services overwrite the oldest entries first, and an active attacker may try to delete them. Make a list in advance of the logs that matter, typically firewall, VPN, directory and authentication, e-mail, endpoint console and DNS, and how to export each one. During the incident, copy them to storage outside the affected systems, record the time and a hash of each file, and raise retention on the devices if you can. Ask your cloud providers how far back their audit logs go. NetSenX stores its alerts in its own service for the alert history your plan includes, 30 days on Free and longer on paid plans, whatever happens to your devices.