Every detection assumes the data exists. If the log source isn't onboarded - or silently stopped - your rule can't fire. Log source onboarding is the unglamorous foundation of detection engineering.
Prioritize the high-value sources
You can't onboard everything at once. Start where detections pay off most:
- Authentication/identity - Windows security logs, Azure AD/Entra, VPN, Okta.
- Endpoint - EDR + Sysmon (process creation is gold).
- Cloud audit - CloudTrail / Azure Activity / GCP audit.
- Network - firewall, proxy, DNS, Zeek.
- App + email - web server logs, email security.
Onboard it properly
- Confirm the RIGHT events - e.g. enable PowerShell Script Block Logging and Sysmon; default logging often misses what you need.
- Parse + normalize - map fields to a common schema (like OCSF/ECS) so rules work across sources.
- Time sync - accurate, consistent timestamps (NTP) or correlation breaks.
Validate + monitor freshness
Onboarding isn't done at first ingest. Alert when a log source goes silent - a quiet source means either a benign outage or an attacker who cut your visibility. Periodically prove your key detections still fire (purple-team the pipeline). No data, no detection.