While I applaud the move from Microsoft to finally expose more logging to users, it’s kind of silly that it takes years before having some logs accessible while such logs were easily accessible on on-premises software…

I remember some discussions in incident response where we could not get logs because “Microsoft knows better than you how to analyse those logs”.

Maybe it’s time to finally get access to logs from all those SaaS and cloud vendors who usually deny you access as a customer to your own logs. Even if some customers lack the capabilities to analyse their own logs, having the logs help to spot specific attacks or better response to incidents.

I bet it will again take times to have logging capabilities in default entry-level cloud services.

#logging #dfir #incidentresponse

https://www.microsoft.com/en-us/security/blog/2023/07/19/expanding-cloud-logging-to-give-customers-deeper-security-visibility/