Beginner asking: What logs are absolutely essential to send?

Hello everyone,

I've noticed a common point of confusion for teams just starting their SIEM journey, especially with a platform like Exabeam, is figuring out which data sources to prioritize. It's easy to get overwhelmed by the sheer volume of potential logs. From a Kubernetes and cloud-native perspective, I think about this in layers: you need foundational visibility first, then security-specific signals, and finally, business-context logs.

Based on my experience wrangling clusters and parsing telemetry, here are the absolute essential categories I would send on day one:

**1. Identity & Access Logs**
This is your primary evidence for any user or system action. Without this, you can't trace who did what.
* **Active Directory / LDAP / Azure AD / Okta:** All authentication, authorization, and session management events.
* **VPN & Firewall (Network Perimeter):** Successful and failed login attempts, especially from external IPs.
* **Privileged Access Management (PAM) & Jumpboxes:** Every command and session for privileged accounts.
* **SSH/RDP Logs:** From critical servers and network devices.

**2. Core Infrastructure & Network Logs**
These provide the context of *where* and *how* an action took place.
* **Firewall & Proxy (Forward/Reverse):** All allow/deny traffic decisions. This is crucial for understanding data flows and potential exfiltration.
* **DNS Query Logs:** Often the first beacon in a compromise. Look for anomalous domains, high-frequency queries, or NXDOMAIN floods.
* **Core Network Devices (Switches, Routers):** ACL hits, configuration changes, and interface status alerts.

**3. Critical Endpoint & Server Logs**
The systems where the data and applications live.
* **Operating System Security Logs (Windows Security, Linux auditd):** These are non-negotiable. User logon/logoff, privilege use, process creation, and file access on sensitive systems.
* **Antivirus / EDR / Host IPS Alerts:** Tuned to reduce noise—send the detections and critical prevention events.
* **Cloud Infrastructure Audit Trails:** For AWS, this is CloudTrail; for GCP, Audit Logs; for Azure, Activity Logs. Focus on administrative activity (create, modify, delete) for IAM, Compute, Storage, and Database services.

**4. Application & Specialized System Logs**
Target your most critical business applications.
* **Database Audit Logs:** Failed logins, bulk data exports, schema changes, and privileged data access.
* **Web Server/Access Logs:** From your public-facing applications.
* **Email Gateway Logs:** Message tracing, spam/malware filtering results, and large outbound sends.

A practical tip: start with a narrow, high-fidelity feed. It's better to have 10 critical log sources parsing correctly than 100 with broken parsers and null fields. In a Kubernetes environment, this means ensuring your log forwarders (like Fluentd or Fluent Bit daemonsets) are configured to pick up these host and container logs, and your Exabeam parsers are validated.

For example, a minimal Fluent Bit filter to ensure a Linux auth log is tagged correctly might look like this in your ConfigMap:
```yaml
[FILTER]
Name parser
Match host.auth.*
Key_Name log
Parser syslog-rfc3164
Reserve_Data On
```

The goal is to build a timeline. If you can see a user authenticate (1), run a process (3), and send data out (2), you've got the foundation of an investigation. Everything else enriches that story.

What has been your experience? Are there any logs in this list you found surprisingly high-value, or any crucial ones I've missed for a modern, cloud-native environment?

kubectl apply -f