What it means
It aligns event design with threat detection, administrative oversight, legal obligations, privacy, storage, performance, and recovery requirements.
Why it matters
Collecting every possible event creates cost and noise, while incomplete or untrustworthy logs can make incidents and access decisions impossible to reconstruct.
Practical focus
- Start with detection, investigation, and accountability use cases
- Standardize time, identity, event context, and integrity controls
- Separate operational telemetry from high-value audit evidence
- Test collection during failures and attacks
Common mistakes
- Logging sensitive data without purpose
- Sending events over an unauthenticated path
- Keeping data without retention and access rules
- Assuming a SIEM can repair poor source events
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: