Does the Applicant employ SIEM, log centralization, and audit logging across firewalls + IDS?
Centralization matters for a specific reason: an attacker who compromises a system deletes its local logs and cannot reach the copy that already left.
What the carrier is actually asking
The carrier is asking whether logs from across the estate are collected into one place and analysed, rather than sitting on each device. It names firewalls and intrusion detection deliberately, because network telemetry is often the part left uncollected.
Why it is underwritten
Detection requires correlation across sources, and investigation requires logs that survive the compromise. Without centralization, an intrusion is reconstructed from whatever the attacker did not delete, which raises forensic cost and forces conservative notification decisions. The carrier funds both.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Cloud log routing is directly measurable, and it is the half of the estate most often left at portal defaults.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Azure | Diagnostic setting on the subscription activity log | Present, capturing all categories, routed to a workspace or storage with defined retention |
| Azure | Resource-level diagnostic settings across services | Coverage across key vaults, storage, databases, and network resources rather than a handful of workloads |
| Entra ID | Diagnostic settings exporting sign-in and audit logs | Exported, since in-portal retention is short and cannot be extended in place |
| Microsoft 365 | Unified audit log enabled and exported | Enabled, with export where retention beyond the licence default is required |
| Network | Firewall and intrusion detection logs forwarded to the same destination | Network telemetry collected centrally. Attested for on-premises devices |
A workspace receiving everything with no detection rules is an archive. It is genuinely valuable during an investigation and it detects nothing on its own. Answer this question accurately: collected, and analysed by whom.
What a defensible yes requires
- Identity, cloud control plane, endpoint, and network logs reach a central destination.
- Retention is set deliberately and matches the investigation window you claim elsewhere.
- Detection rules exist, or a provider supplies them.
- Alerts route to a monitored destination.
- Log source health is monitored, since sources stop reporting quietly.
How this answer goes wrong
Identity and endpoint logs are collected and the cloud subscription activity log has no diagnostic setting at all, so resource-plane changes are retained for ninety days in the portal and nowhere else. The second failure is a source that stopped forwarding months ago and nobody noticed, because nothing alerts on absence.
Frequently asked
Do we need a commercial SIEM?
No. A Log Analytics workspace with retention and some detection rules answers this question. The platform matters less than coverage, retention, and whether anyone reads it.
What sources matter most?
Identity first, then cloud control plane, then endpoint, then network. Identity logs answer more investigative questions than anything else in a cloud estate.
How long should logs be kept?
Long enough to cover the gap between compromise and detection. A year for security-relevant sources is a defensible answer.
How do we know a source stopped reporting?
Alert on absence of expected data. It is the most commonly missing monitoring rule and it catches the most consequential failure.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture