--- title: "Does the Applicant employ SIEM, log centralization, and audit logging across firewalls + IDS?" url: https://insuranceposture.com/questions/network-and-logging/applicant-employ-siem-log-centralization-audit-logging-across-firewalls category: "Network, logging and monitoring" canonical_key: q_aud_001 evidence_state: partial updated: 2026-08-24 --- # Does the Applicant employ SIEM, log centralization, and audit logging across firewalls + IDS? URL: https://insuranceposture.com/questions/network-and-logging/applicant-employ-siem-log-centralization-audit-logging-across-firewalls Section: Network, logging and monitoring Evidence state: Partly verifiable from your tenant Centralization matters for a specific reason: an attacker who compromises a system deletes its local logs and cannot reach the copy that already left. ## What the carrier is actually asking The carrier is asking whether logs from across the estate are collected into one place and analysed, rather than sitting on each device. It names firewalls and intrusion detection deliberately, because network telemetry is often the part left uncollected. ## Why it is underwritten Detection requires correlation across sources, and investigation requires logs that survive the compromise. Without centralization, an intrusion is reconstructed from whatever the attacker did not delete, which raises forensic cost and forces conservative notification decisions. The carrier funds both. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Cloud log routing is directly measurable, and it is the half of the estate most often left at portal defaults. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Azure | Diagnostic setting on the subscription activity log | Present, capturing all categories, routed to a workspace or storage with defined retention | | Azure | Resource-level diagnostic settings across services | Coverage across key vaults, storage, databases, and network resources rather than a handful of workloads | | Entra ID | Diagnostic settings exporting sign-in and audit logs | Exported, since in-portal retention is short and cannot be extended in place | | Microsoft 365 | Unified audit log enabled and exported | Enabled, with export where retention beyond the licence default is required | | Network | Firewall and intrusion detection logs forwarded to the same destination | Network telemetry collected centrally. Attested for on-premises devices | **Collection is not analysis** A workspace receiving everything with no detection rules is an archive. It is genuinely valuable during an investigation and it detects nothing on its own. Answer this question accurately: collected, and analysed by whom. ## What a defensible yes requires - Identity, cloud control plane, endpoint, and network logs reach a central destination. - Retention is set deliberately and matches the investigation window you claim elsewhere. - Detection rules exist, or a provider supplies them. - Alerts route to a monitored destination. - Log source health is monitored, since sources stop reporting quietly. ## How this answer goes wrong Identity and endpoint logs are collected and the cloud subscription activity log has no diagnostic setting at all, so resource-plane changes are retained for ninety days in the portal and nowhere else. The second failure is a source that stopped forwarding months ago and nobody noticed, because nothing alerts on absence. ## If this answer turns out to be wrong Remote access exposure and log retention are what a forensic report describes first, which makes them the answers most often revisited after a loss. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Do we need a commercial SIEM? No. A Log Analytics workspace with retention and some detection rules answers this question. The platform matters less than coverage, retention, and whether anyone reads it. ### What sources matter most? Identity first, then cloud control plane, then endpoint, then network. Identity logs answer more investigative questions than anything else in a cloud estate. ### How long should logs be kept? Long enough to cover the gap between compromise and detection. A year for security-relevant sources is a defensible answer. ### How do we know a source stopped reporting? Alert on absence of expected data. It is the most commonly missing monitoring rule and it catches the most consequential failure. ## Related questions - [How long are audit logs maintained (30 / 90 / 1 year)?](https://insuranceposture.com/questions/network-and-logging/long-audit-logs-maintained) - [Are administrator privileged access activities audited?](https://insuranceposture.com/questions/access-control/administrator-privileged-access-activities-audited) - [Does the Applicant have a Security Operations Center (SOC) monitored 24/7?](https://insuranceposture.com/questions/network-and-logging/applicant-security-operations-center-monitored-24-7) - [Does local logging happen per-host?](https://insuranceposture.com/questions/network-and-logging/local-logging-happen-per-host) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.