A city's SOC wants better visibility across utility SCADA jump hosts, ERP, and public web apps. What logging approach best supports monitoring and actionable alerting?

Security operations for a city depend on correlating events across systems that individually look benign. Centralizing security-relevant logs in a SIEM (or equivalent platform), retaining them according to policy and legal needs, and tuning alerts so analysts receive actionable signals enables detection of lateral movement, privilege abuse, and multi-stage attacks that span identity, endpoint, and network layers. Retention suited to policy supports investigations and audits; tuning reduces alert fatigue so genuine anomalies receive response. Forwarding, normalization, and use-case driven detection content turn raw syslog into operational value for the SOC or MSSP supporting municipal services.

Disabling central logging to save storage and relying on verbal shift handoffs eliminates durable evidence and correlation; verbal briefings cannot reconstruct an attacker’s path weeks later. Retaining logs for only a few minutes and never forwarding them to analysts makes detection and forensics effectively impossible. Storing each system’s logs only on that system with no correlation capability leaves silos that ransomware or attackers can wipe locally while hiding cross-system patterns. Exam caveat: logging without retention, integrity protection, and review is incomplete—CISSP stresses monitoring that supports detection and investigation. Operationally, define a minimum logging baseline for financially and safety-critical systems, verify forwarders with canary events, and review SIEM use cases quarterly against the city’s threat scenarios.