When something goes wrong — a compromised mailbox, missing money, a ransomware note — the first question is always the same: what actually happened, and since when? Logs are the only honest answer to that question. Without them, incident response is guesswork, insurance claims get complicated, and “we don’t know what they accessed” becomes your official position. The good news: useful logging at small-business scale isn’t an enterprise SIEM project. It’s keeping five sources, extending how long they’re kept, and being honest about the difference between recording and watching.

What logs actually buy you

Three things. Reconstruction: after an incident, logs are how responders determine what the attacker touched — which decides whether you’re notifying one client or all of them, a distinction breach-notification laws care about intensely. Early warning: many attacks announce themselves in logs days or weeks before the damage — the sign-in from a country nobody’s in, the new mail-forwarding rule at 3 a.m., the admin account doing something admins don’t do. Proof: insurers, auditors, and regulated-industry examiners increasingly ask about logging by name, because claims without logs are disputes.

The five sources worth keeping

  1. Identity and sign-in logs — Microsoft 365 / Google Workspace sign-ins, MFA events, and account changes. The single most valuable source, because most modern attacks are just logins with stolen passwords, and this is where they show.
  2. Email system audit logs — forwarding rules created, permissions changed, unusual send patterns. A new auto-forward to an external address is the classic first move inside a compromised mailbox; it appears here and almost nowhere else.
  3. Endpoint logs via EDR — what actually ran on each computer, recorded with the timeline responders need. If you have EDR, you have this; it’s half of what you’re paying for.
  4. Firewall and remote-access logs — who connected from outside, when, from where. Also where vendor connections become visible, which matters because nobody watches those otherwise.
  5. Server and application audit trails for the systems holding your Restricted data — the accounting platform, the client-records system. When the question is “who opened that file,” this is the only place the answer lives.

The two settings that fix most logging

Most businesses technically have these logs and still can’t answer questions, for two fixable reasons. Retention is too short: many defaults keep 30–90 days, and the awkward reality is that breaches are frequently discovered months after they start — a log that expired before discovery is a log you never had. Extend retention on the five sources to at least six months, ideally a year; in Microsoft 365 this is largely a licensing-and-settings exercise, not a project. Audit features aren’t turned on: several valuable logs (mailbox auditing, detailed sign-in records) exist only if enabled. A one-hour review with whoever runs your IT — “are these five sources on, and how long do they keep?” — is the highest-value logging work most small businesses will ever do.

Recording vs. watching — the honest distinction

Everything above makes you good at afterward. Logs that no one looks at prevent nothing; they just make the autopsy accurate. Actual prevention requires someone — or something — noticing the weird sign-in before the wire transfer. The right-sized ladder:

  • Alerts on the loud signals — impossible-travel sign-ins, new forwarding rules, new admin accounts, mass file activity. Microsoft 365 and most platforms can raise these natively; the requirement is that they route to a human who reacts, not an inbox that files them.
  • Managed detection and response — the practical way a small business gets 24/7 human eyes, since attackers deliberately work your off-hours and no small company staffs three shifts of analysts. This is why MDR is built into our managed plans rather than sold as an add-on: recorded-but-unwatched was never real protection.
  • A full SIEM (a platform aggregating and correlating everything) — genuinely valuable, and genuinely overkill for most businesses under a few hundred seats unless a regulator or contract requires it. If someone’s quoting you one, ask what specific question it answers that the ladder below it doesn’t.

The bottom line

Logging is the difference between “we don’t know what happened” and a timeline; monitoring is the difference between a timeline and a prevented incident. Turn on the five sources, stretch retention past the discovery gap, alert on the loud stuff, and put humans behind the alerts at whatever rung fits your size. None of it is glamorous — which is true of most things that end up deciding how bad your worst day gets.