[Autogenerated] How frequently should you review the logs?
So the requirement talks about daily review.
Right?
And in practice,
I think what that means is you need to deal with your alerts on a daily basis.
Right?
Right.
So, uh,
if you've got whatever your criteria are to come up with interesting things,
yeah, right.
Go deal with those at least every day, right?
I don't think that necessarily means that you've got to go scroll
through a gig worth of log lines every day again.
That that's not the point.
But if you got to also make you to reviewing effectively reviewing the logs,
consolidating, looking for something in producing alerts a song,
they respond to those alerts every day.
That makes the intent of the E.
I think so.
Yeah, it's not.
You don't have to have a human doing it every day.
It could be an ultimate do, right?
Yeah, But again, the analysis is increasingly sort of machine based, right?
And And the idea that that humans error really capable of doing the analysis?
Um, is right.
They never have.
You just pretended right?
And and so I mean, yeah.
You want some humans doing the engineering of building
that analysis set of tools right on.
That's that's serious hard work, right?
That's that's skilled, you know, a specialist information, security stuff.
And and that's not easy.
Um, but but I think that's how you get useful stuff out of your log data, right?
I mean, I'm sure there was a log repository full of interesting data,
you know, in insert security incident here.
Absolutely.
Right.
And?
And maybe they were getting alerts on the salient
events and maybe they weren't right.
Um, the standard split reviewing of logs into two.
I think it was in version 3.1 of version 3.2,
because you now got the requirement, you know,
to review something's daily, and then other system components periodically,
periodically.
Well, what's periodic?
I mean, you know what?
What to you is that you say what is periodically mean.
So So the notion behind that requirement is Go look at your
kind of log data for your non CD or your non scope
environment to make sure that there's not,
you know, potentially adverse stuff.
Kind of happening around the edges.
Right?
Okay, So maybe the bad guy isn't in your CD.
Maybe isn't in your in scope environment.
But if there's evidence in the log data for the adjacent
systems that the bad guy is poking at the edges,
I think you want to know that, all right,
I think you want to know that.
So, uh, you know what is the period?
I think that's a little bit like 9.9 that we discussed previously.
You gotta make some decisions about what is a good faith
sort of justifiable period for that.
Maybe that's not every day.
Maybe that's every week or every month.
I don't know, right, or it's going to be situation specific.
Uh,
but that's what you want to do is come up with your sort of rationale for that.