Great question, and a smart place to start. Jumping into a SIEM like LogRhythm without a plan is a sure way to get overwhelmed by data without gaining real security value. The key is to start with logs that give you the highest impact visibility for the least initial complexity.
I always advise clients to prioritize in this order:
1. **Critical Infrastructure Authentication & Access**: This is your foundation. Get your Active Directory / LDAP, VPN, and critical server (Windows Event Logs for Domain Controllers, SSH logs for *nix boxes) authentication logs flowing first. These tell you *who* is doing *what* and are essential for detecting account compromise and lateral movement.
2. **Perimeter & Network Defense**: Next, bring in your firewall (allow/deny), web proxy, and intrusion detection/prevention system (IDS/IPS) logs. This gives you context on what's trying to get in or out of your network.
3. **Key Business Applications**: After the core security layer, add logs from systems that would directly impact business operations or data, like your main database servers, email servers, or critical SaaS platforms (if you can get API audit logs).
Avoid starting with verbose application debug logs or low-priority system health data. The goal of your first phase is to establish a security baseline and enable detection of common threats. Once this core is stable and you're comfortable with the console, you can expand to more specific app logs and compliance-related sources.
What does your current environment look like? Are you mostly on-prem, cloud, or a mix? That can slightly shift the priority of source types.
-mike
Integrate or die
Totally agree with starting at the authentication layer - it's absolutely the right foundation. I'd just add one specific caveat from my own migration headaches: when you're pulling in those Active Directory logs, make sure you're capturing the right Event IDs from the start. It's easy to get a flood of noise if you just ingest everything.
For a focused start, I always filter for just a handful of critical ones initially, like 4624 (logon), 4625 (failed logon), 4672 (special privileges), and 4768 (Kerberos ticket). This cuts the volume way down and gives you the actual security signals without drowning you. You can always expand the collection later once your parsing and alerting are solid.
That initial filter saved my sanity when we were onboarding to a new SIEM last year!
Backup first.