Before adding AI to security operations, make sure the logs exist, are complete, carry reliable timestamps and are kept long enough to use. A model cannot analyze events you never collected. Most disappointing AI triage results trace back to gaps in the data underneath.
What NIST offers
NIST SP 800-92, Guide to Computer Security Log Management, by Karen Kent and Murugiah Souppaya, was published in September 2006. NIST describes it as practical guidance for building, running and maintaining log management across an organization, and says it is not a step by step guide to implementing logging technologies. It is old, so use it for principles and check current vendor documentation for specifics.
The basics to check
Coverage. List your key systems: identity provider, cloud accounts, endpoints, servers, email, network edges and critical applications. For each, mark whether logs are collected, and which events.
Completeness. Are you collecting the events that matter, such as authentication, privilege changes and process creation, or only the default minimum?
Time. Check clocks are synchronized and every source records time in a known zone. Timelines built on inconsistent time lead to wrong conclusions, from people or models.
Retention. Keep logs long enough for investigations to look back. Pick a period using your incident, legal and storage constraints, and write it down.
Integrity. Restrict who can alter or delete logs. Forward them to a place a compromised host cannot edit.
Format. Consistent field names make rules and queries reusable. Mixed formats cause both human and model errors.
Access. Know who can read logs, since they contain personal and sensitive data. See what log data to redact.
Why this comes before AI
Detection rules depend on log sources. A Sigma rule has to name the log source it applies to, and an optional definition field can describe how to onboard it. If the source is not collected, the rule can never fire, however well a model wrote it.
For triage, context matters: an asset inventory, user directory and history of similar alerts. An assistant given thin context gives thin answers.
A one week audit
- Day 1: list systems and log sources.
- Day 2: test that a known action in each system appears in your search tool.
- Day 3: check time sync and zones.
- Day 4: confirm retention and who can delete.
- Day 5: pick the top ten gaps and assign owners.
Fixing these also helps humans, who face the same blind spots. When you are ready, begin with the small steps in detection engineering vs threat hunting vs alert triage.
Quick check
Do I need a SIEM to start?
You need searchable, retained logs in one place. The product matters less than coverage, time quality and retention.
Is the 2006 NIST guide still useful?
For principles, yes. Treat product details in it as dated and rely on current documentation for your tools.
Sources
Last reviewed: 19 October 2026.
