Start with the sources that tell you who signed in, what happened on endpoints, what arrived by email, and who changed administrative settings. Those four cover the most common attack paths and are usually straightforward to collect.
A first tier
- Identity provider sign-in and audit logs, including MFA events and failed attempts.
- Endpoint detection alerts and, where volume allows, process telemetry.
- Email security events: delivered, quarantined and user-reported messages.
- Admin audit logs from cloud platforms and key SaaS applications.
Then widen
Firewall and VPN logs, DNS queries and server event logs come next. Add them once the first tier produces alerts that someone actually reviews. Ingesting everything at once tends to produce cost and noise rather than visibility.
Make it usable
Synchronise clocks and keep time zones consistent, normalise user and host names so events correlate, and set retention to match your investigation and compliance needs.
Related: logging and alerting integration and connecting SSO and MFA to your tools.