SECURITY-OPERATIONS-SOC5 MIN READ
Log Quality Is Detection Quality
Assess whether a SOC alert has enough logging context to support action.
The reframe: Alert severity is not the same as evidence quality. Completeness The log needs the fields that answer the question. For identity, that may be user, device, MFA, app, IP, geo, risk score, and session outcome. Timeliness Delayed logs can turn a containment call into a historical report. Always know whether you are looking at near-real-time telemetry or batch arrival. Normalization Fields must mean the same thing across sources. A success field, an action field, and a verdict field are easy to misread when each vendor names them differently.
Read the full lesson
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in