What security logs you actually need and why

## Executive summary This guidance explains which security logs UK SMEs should prioritise—identity/sign-in, endpoint/device, email/collaboration, and core infrastructure—why those logs help detect and investigate incidents, how to balance retention costs against investigation value, and provides a practical starter checklist and common pitfalls to avoid.