Breaches that go unseen get expensive. IBM's 2025 Cost of a Data Breach study put the average time to identify and contain a breach at 241 days, and found organisations that detected a breach themselves saved about USD 900,000 compared with those told by the attacker. Good security logging does not need an enterprise budget. This guide covers what to log, where to keep it and what it costs.
Why logging is a security control, not just debugging
Application logs usually exist for developers chasing bugs. Security logs answer a different question: who did what, from where, and was it allowed? The OWASP Top 10:2025 keeps Security Logging and Alerting Failures at A09, renamed from monitoring to stress that a log nobody is alerted on rarely stops an attack. International guidance agrees. In August 2024, cyber agencies from Australia, the US, the UK, Canada, New Zealand, Japan, Korea, Singapore and the Netherlands published joint best practices for event logging and threat detection, coordinated by Australia's ASD.
The four principles from the joint guidance
The ASD-led guidance, published by CISA among others, rests on four factors. They scale down well to a small company if you treat each as a short written decision: one page saying what you log, where it goes, who can read or delete it, and which threats you are watching for. The guidance itself is aimed at medium to large organisations, so keep only what fits.
- An event logging policy the organisation has approved
- Centralised log collection and correlation
- Secure storage that protects log integrity
- A detection strategy aimed at the threats relevant to you
What to log and what never to log
The OWASP Logging Cheat Sheet gives a practical list: authentication successes and failures, authorisation failures, session problems such as tampered cookies or invalid tokens, input validation failures, admin and privilege changes, use of shared or break-glass accounts, data exports and key rotation. Each event should say when, where, who and what, with a request ID that links related events.
Equally important is what to leave out. OWASP says never to log passwords, access tokens, session IDs, connection strings, encryption keys or payment card data, and to mask personal data. It also warns against logging everything, because noise hides real problems.
India: CERT-In's logging and reporting rules
Indian companies have a legal reason to log. CERT-In's Directions of 28 April 2022, in force from 27 June 2022, require covered entities to enable logs on their ICT systems and keep them for a rolling 180 days, to be provided to CERT-In on request or when reporting an incident. Specified incidents must be reported within 6 hours of becoming aware of them.
CERT-In's FAQs also ask entities to synchronise system clocks to NIC or NPL time servers, or sources traceable to them, and allow cloud users to rely on their provider's native time service. Accurate timestamps are what make logs usable in an investigation.
What centralised logging costs
Prices below are list prices published by each provider and vary by region and volume, so check the calculator for your own setup. They show that a small SaaS product can centralise security logs for very little, provided it controls volume. Note that Grafana's Pro figures are starting rates, and CloudWatch's free allowance is shared across ingestion, archive and query scans.
| Option | Free allowance | Paid pricing published | Notes |
|---|---|---|---|
| Amazon CloudWatch Logs | 5 GB per month (ingestion, archive, Insights scans) | USD 0.50 per GB standard ingestion; USD 0.25 per GB Infrequent Access; USD 0.03 per GB-month archive | US East example rates |
| CloudWatch alarms | 10 alarm metrics | USD 0.10 per alarm metric per month | Composite alarms USD 0.50 each |
| Grafana Cloud Logs (Free) | 50 GB per month, 14-day retention | USD 0 | No credit card required |
| Grafana Cloud Logs (Pro) | 50 GB included | USD 19 per month platform fee, then usage-based | 30-day retention included |
Keeping costs down without losing visibility
Log bills are driven by volume, and debug and verbose access logs usually make up most of it, while the security events OWASP lists are a small fraction. Send security events to a dedicated stream with longer retention, and keep noisy application logs on short retention or a cheaper tier.
Note the retention gap: a 14-day free tier will not meet CERT-In's 180 days on its own. A common pattern is short hot retention for search plus low-cost archive storage for the remainder, as CloudWatch's archive rate illustrates. Protect the archive with restricted, audited access and write-once settings where available.
The first alerts worth setting
A small team should start with a handful of alerts that are rarely false and always worth waking up for. Add more only when these are tuned. Route alerts to a channel someone actually watches, and give each one a short note explaining what to check first, so whoever is on call can act without guessing.
- Many failed logins for one account, or across many accounts from one source
- Successful login to an admin account from a new country or device
- New admin user, role change or MFA disabled
- A user hitting an unusual number of other tenants' object IDs
- Cloud audit events: new access keys, disabled logging, public storage
- Large data exports outside normal hours
Making logs useful when something goes wrong
Logs earn their keep during an incident. Use structured JSON rather than free text, which OWASP also recommends as a defence against log injection, include a request ID across services, and keep a short written guide to where each log lives. Test it once a quarter by tracing a single user action end to end. XDQ Labs designs logging and alerting for products it builds and secures, and the same principles fit any small team.
Frequently asked questions
What security events should a small company log?
Start with authentication successes and failures, authorisation failures, admin and permission changes, data exports, configuration changes and cloud audit events. OWASP's Logging Cheat Sheet adds input validation failures and session problems. Never log passwords, tokens, session IDs or card data.
How long must logs be kept in India?
CERT-In's Directions of April 2022 require covered entities to keep ICT system logs for a rolling 180 days and provide them to CERT-In on request or when reporting an incident. Sector regulators or contracts may require longer, so check any rules that apply to your business.
What is the cheapest way to centralise logs?
For low volumes, free tiers go a long way. CloudWatch Logs includes 5 GB a month free and Grafana Cloud's free tier includes 50 GB a month with 14-day retention. Add low-cost archive storage to meet longer retention needs.
Do I need a SIEM as a startup?
Not at first. Centralised logs, a few well-chosen alerts and a written process for reviewing them cover most early needs. A SIEM or managed detection service makes sense as log sources, customers and compliance demands grow.
Sources
- Logging Cheat Sheet, OWASP Cheat Sheet Series, 2025
- Best practices for event logging and threat detection, Australian Signals Directorate (ACSC), 2024
- Best Practices for Event Logging and Threat Detection, CISA, 2024
- An Overview On The CERT-In Cyber Security Directions, 2022, Mondaq, 2022
- CERT-In releases FAQs explaining the Direction on cybersecurity, Nishith Desai Associates, 2022
- Amazon CloudWatch Pricing, Amazon Web Services, 2026
- Grafana Cloud Logs, Grafana Labs, 2026
- Average global data breach cost now $4.44 million (IBM Cost of a Data Breach Report 2025), Help Net Security, 2025
- OWASP Top 10:2025 Introduction, OWASP Foundation, 2025
