soc

Logging for companies that can't justify a SIEM yet

If you had to answer 'who logged in, and what changed?' tomorrow, could you? A small logging setup, and the Windows event IDs worth keeping.