log-management-nist-800-92

Guides security log management planning, collection, retention, and analysis per NIST SP 800-92.

Updated Jun 5, 2026

Search Tags:#compliance #log management #siem #security monitoring #log retention #incident detection #nist sp 800-92

Ready to run

npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill log-management-nist-800-92-yogiex

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: log-management-nist-800-92
Source: https://github.com/yogiex/opencode-cyber-security-skills/tree/main/skills/log-management-nist-800-92
Command: npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill log-management-nist-800-92-yogiex

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Organizations struggle to design and operate security logging programs that actually support incident detection, forensics, and compliance. This Skill provides structured guidance based on NIST SP 800-92 for planning, collecting, storing, analyzing, and retaining security logs. ## Core Features & Use Cases - Log Management Planning: Define logging policies, prioritize log sources by risk, and plan staffing and review responsibilities. - Infrastructure & Storage Guidance: Compare centralized vs decentralized architectures, plan volume and storage tiering, and enforce NTP time synchronization. - Retention & Compliance Mapping: Match retention periods to PCI DSS, HIPAA, SOX, GDPR, and other frameworks, with secure archival and disposal procedures. - Use Case: A SOC manager designing a new SIEM deployment uses this Skill to prioritize log sources, estimate daily log volumes, define alerting rules, and set retention policies that satisfy PCI DSS requirements. ## Quick Start Ask the agent to design a log management policy for your organization following NIST SP 800-92, including prioritized log sources and retention periods.

Frequently Asked Questions about log-management-nist-800-92

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I design a log management policy following NIST SP 800-92?▼

Start by defining logging objectives such as incident detection, compliance, or forensics, then prioritize log sources by asset risk. NIST SP 800-92 recommends documenting verbosity levels, review frequency, retention periods, and secure disposal procedures in a formal policy.

Which log sources should be prioritized for security monitoring?▼

Critical sources include authentication servers, firewalls, IDS/IPS, and domain controllers because they detect unauthorized access. High-priority sources include web servers, databases, and VPNs, while DNS and cloud audit logs provide investigation context.

How long should security logs be retained for compliance?▼

Retention depends on the framework: PCI DSS requires 12 months, HIPAA requires 6 years, SOX requires 7 years, and GDPR follows a purpose-based approach. Authentication logs generally need at least one year for forensic reconstruction.

Centralized vs decentralized logging: which architecture is better?▼

NIST recommends centralized logging for all critical sources because it enables correlation, simplifies forensics, and eases compliance auditing. Decentralized approaches distribute load but fragment visibility and risk log loss, so centralization with redundancy is preferred.

Why is NTP time synchronization important for log management?▼

Without synchronized timestamps, incident reconstruction across systems is impossible. All systems should use the same NTP source, log in UTC, and be audited for clock drift, since deviations over one second can break event correlation.

When should I not use this log management guidance?▼

This guidance covers management practices, not tool-specific configuration for Splunk, ELK, or syslog-ng, and not hands-on forensic analysis. For threat modeling or incident response procedures, use dedicated skills for those domains instead.