Which cloud and SaaS logs should we switch on and keep?

The ones you will need to answer what happened after an incident: who signed in, what changed and what data was accessed. For each cloud or SaaS service, check that these are on: sign-in logs with location and device; admin and configuration changes, such as new roles, policies, forwarding rules and app consents; access to files and mailboxes where the service offers it; API activity for cloud accounts; and network flow logs for your cloud networks if you run servers there. Then check how long each is kept by default, because some services keep only a short window unless you pay for more or export them. Store copies somewhere the admins of that service cannot delete, so an attacker with admin rights cannot erase the trail. Decide who reviews them and which events raise an alert. Incident reporting under NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. and GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)., and your insurer, will expect you to reconstruct a timeline. A network sensor adds the device side of that timeline: NetSenX keeps alerts for the period your plan includes, with hosts, destinations and times.

← All 25 questions on Cloud and SaaS securityAll topics