DE.AE-1.1: The organization shall ensure that a baseline of network operations and expected data flows for its critical systems is developed, documented and maintained to track events.
Consider enabling local logging on all your systems and network devices and keep them for a certain period, for example up to 6 months.
Ensure that your logs contain enough information (source, date, user, timestamp, etc.) and that you have enough storage space for their generation.
Consider centralizing your logs.
Consider deploying a Security Information and Event Management tool (SIEM) that will facilitate the correlation and analysis of your data.
Description
The organization shall ensure that a baseline of network operations and expected data flows for its critical systems is developed, documented and maintained to track events.