Understanding Log Tiers and Best Practices

One of the most common questions I encounter is, "Where do the Azure logs go?" Surprisingly, the responses vary from "I have no clue" to "I think we get some of the alerts in the SIEM." This ambiguity highlights a crucial gap in many organizations' understanding of their Azure environment's logging infrastructure

Effective log collection is the cornerstone of robust cloud security and compliance practices. Without clear visibility into your Azure logs and a well-defined strategy for collecting and analyzing them, you could be leaving your organization vulnerable to threats and compliance violations.
To address this challenge, it's essential to establish clear log collection tiers and standards across your Azure tenant. These tiers define the types of logs to collect, their significance, and the level of detail required for each.

Tier	Background	Logs Included
Tier 1	Bare minimum for essential Production workloads	- Common Logs for Windows Servers - Syslog Logs (non-debug) for Linux Servers - AKS Diagnostic Logs T1 (kube-audit-admin & guard) - Key Vault Audit Logs - Azure Activity Logs - Entra ID Signin Logs (all including Graph) - Bastion Audit Logs - Recovery Vault Audit Logs - Automation Audit Logs - Container Registry Audit Logs
Tier 2	Often reached via incident retrospectives	- NSG Flow Logs - NetworkSecurityGroupEvent Logs - DeviceProcessEvents/DeviceNetworkEvents Logs - App Gateway/FrontDoor Logs - Firewall Logs - VM Insights Logs - AKS Container Insights Logs
Tier 3	Granular detail not often feasible in commercial enterprise settings	- AKS Diagnostic Logs T3 - Container App Logs - Database Logs (SQL, CosmosDB, etc) - App Service/Function Logs - Firewall Logs T3 - Application Insights Logs - AKS Syslog Logs - API Gateway Logs - Storage Logs

I would highly recommend creating useful analytics queries and hunting rules that actually use your logs so your SOC can alert. And lastly I think threat modeling on custom apps and ingesting those logs is equally important to ingest as tier 2. The latter requires some more effort and understanding of the actual apps though