# Which cloud and SaaS logs should we switch on and keep?

The ones you will need to answer what happened after an incident: who signed in, what changed and what data was accessed. For each cloud or SaaS service, check that these are on: sign-in logs with location and device; admin and configuration changes, such as new roles, policies, forwarding rules and app consents; access to files and mailboxes where the service offers it; API activity for cloud accounts; and network flow logs for your cloud networks if you run servers there. Then check how long each is kept by default, because some services keep only a short window unless you pay for more or export them. Store copies somewhere the admins of that service cannot delete, so an attacker with admin rights cannot erase the trail. Decide who reviews them and which events raise an alert. Incident reporting under NIS2 and GDPR, and your insurer, will expect you to reconstruct a timeline. A network sensor adds the device side of that timeline: NetSenX keeps alerts for the period your plan includes, with hosts, destinations and times.

FAQ: [Cloud and SaaS security](https://netsenx.com/en/faq/cloud) · https://netsenx.com/en/faq/what-logs-should-we-keep-for-cloud-and-saas

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/eu-data-residency

## Related questions

- [What happens if cloud access keys leak, for example on GitHub?](https://netsenx.com/en/faq/what-happens-if-cloud-access-keys-leak)
- [What is a misconfigured storage bucket and how do we avoid one?](https://netsenx.com/en/faq/what-is-a-misconfigured-storage-bucket)
- [What is the cloud metadata service, and why do attackers want it?](https://netsenx.com/en/faq/what-is-the-cloud-metadata-service-and-why-do-attackers-want-it)
- [How do we spot cryptomining in a compromised cloud account?](https://netsenx.com/en/faq/how-to-spot-cryptomining-in-a-compromised-cloud-account)
- [How do we find SaaS apps that nobody approved?](https://netsenx.com/en/faq/how-to-find-saas-apps-nobody-approved)