The recording of system and security events and their ongoing review to detect anomalies and support investigations.
Logging captures events such as logins, configuration changes, and errors, while monitoring is the active review of those records to spot signs of trouble. Together they give visibility into what is happening across systems.
Good logging supports detection, alerting, and forensic investigation after an incident. Logs must themselves be protected against tampering and retained for an appropriate period.
Related frameworks
KaitoSec