Insufficient Logging and Monitoring

---

Logging & monitoring functions provide administrators and security teams with data to detect potential threats by identifying unusual patterns. Insufficient logging and monitoring refers to a security event not being correctly detected, logged and monitored to ensure adequate and timely response to the incident or breach. Often this is because the logging and monitoring process is missing critical information in the logs, or a lack of proper log format, context or the way it is stored. Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected. Organizations can be severely impacted if a breach goes undetected, resulting in operational, financial, legal, and regulatory issues.