A web log is evidence, not clutter

What the record needs to answer

This is an evergreen control, not a response to a new incident. The National Cyber Security Centre describes logging as the foundation of security monitoring and situational awareness. Its practical test is whether records help answer what happened, what was affected, what should happen next and whether remediation worked. For a public website, that normally requires more than a graph of page views.

Useful sources may include the web server or hosting platform, content management system, web application firewall, identity service, administrator audit trail and relevant cloud control plane. Authentication records can show failed and successful access to an internet-facing service; application records may show who viewed or changed sensitive information; configuration records can show when an administrator, rule or service setting changed. The exact mix depends on the service and the questions the business needs to answer.

Retention without reliability is a false comfort

The NCSC advises organisations to know where logs are stored, make them readily searchable and protect them against tampering and unauthorised access. It recommends retaining records that answer incident questions for at least six months, while recognising that cost, volume and usefulness affect the decision. That is a starting point rather than a universal legal retention rule; personal data and contractual obligations still need appropriate handling.

Timing and context matter too. The guidance recommends accurate time synchronisation, UTC timestamps and enough detail to identify relevant machines and accounts. It also warns that default settings may omit fields needed during an investigation. Central collection can make analysis faster, but the NCSC notes that some provider dashboards can remain useful in place. The goal is accessible evidence, not centralisation for its own sake.

What businesses should do

Choose one important web service and write down five questions you would ask after suspicious administrator activity: which account signed in, from where, what changed, what information was accessed and whether the activity continued elsewhere. Map each question to a log source, its owner, its retention period and the route used to retrieve it. Include services operated by an agency, host or software supplier; access that depends on an untested support request is a fragile plan.

Confirm that privileged users cannot quietly alter or erase the only copy of their own activity. Limit log access, protect transport where records cross systems and alert when expected events stop arriving. Then create a harmless, authorised test event, such as a test administrator sign-in and content change, and verify that the time, account, source and action can be found. The NCSC recommends reviewing and validating the logging approach every six to twelve months as technology changes.

CISA's joint publication with the NCSC and other international agencies defines event logging as a baseline that supports operational resilience and network visibility, while explicitly considering constrained resources. Small organisations therefore do not need to collect everything. They do need a deliberate minimum that answers their own incident questions and remains usable under pressure.

• Choose the incident questions before choosing the logging product.
• Record important web, identity, administrator and configuration events.
• Keep timestamps consistent and retain the fields needed for attribution.
• Restrict access and make unauthorised changes detectable.
• Run a harmless test and confirm that someone can find the result.

The Beekeeper view

Logs are often treated as exhaust until an incident turns them into the only witness in the room. A terabyte of inaccessible noise is less useful than a smaller, protected record that shows who entered the website, what they changed and when they did it.

Ask the person who would investigate to retrieve one known event today. If they cannot find it, cannot trust its timestamp or discover that it expired yesterday, the business has learned something valuable without first paying for the lesson in panic.