How to Set Up Security Logging and Monitoring for Your Miami Small Business
Most Miami small businesses have no idea what is happening on their network right now. Security logging and monitoring changes that — giving you the visibility to detect attacks in progress, investigate incidents, and prove compliance. This step-by-step guide covers Windows Event IDs, Microsoft Sentinel setup, and exactly which alerts to configure.
In our 2025 incident data from Miami-Dade businesses, the average attacker spent 47 days inside a network before being detected. Forty-seven days of reading emails, mapping systems, harvesting credentials, and staging data for exfiltration — while the business had no idea anything was wrong. The reason is almost always the same: no logging, no monitoring, no alerts. Security logging and monitoring is the difference between discovering a breach on day 2 and discovering it on day 47 — or never, until the ransomware detonates. This guide walks you through exactly how to set it up, from the Windows Event IDs that matter most to Microsoft Sentinel configuration to the specific alerts that catch real attacks.
Why this matters right now: The 2024 Snowflake cascade (165 organizations breached), the Change Healthcare ransomware attack, and the Salt Typhoon telecom infiltration all shared a common thread — attackers operated undetected for weeks or months because victims had insufficient logging and monitoring. Security logging is not a compliance checkbox. It is the visibility layer that makes every other security control more effective.
What Security Logging and Monitoring Actually Means for a Small Business
Security logging means recording events that happen on your systems — who logged in, what files were accessed, what commands were run, what network connections were made. Security monitoring means reviewing those logs (automatically or manually) to detect patterns that indicate an attack, a policy violation, or a security incident. Together, they give you visibility into what is actually happening in your environment.
For a small business, a complete security logging and monitoring program has four components: endpoint logging (what is happening on individual computers and servers), identity and authentication logging (who is logging in, from where, and when), network logging (what traffic is flowing in and out), and cloud service logging (what is happening in Microsoft 365, Azure, and other cloud platforms). You do not need all four to start — even basic endpoint and identity logging dramatically improves your ability to detect and respond to attacks.
Get monthly IT tips for Miami businesses
No spam · Unsubscribe anytime · Practical advice only
The Minimum Viable Logging Stack for a Miami Small Business
- Windows Security Event Log on all computers and servers: Built into Windows, free, captures authentication events, privilege use, and policy changes
- Microsoft 365 Unified Audit Log: Built into Microsoft 365, captures all user and admin activity across Exchange, SharePoint, Teams, and Azure AD
- Firewall logs: Your business-grade firewall generates logs of all traffic decisions — blocked connections, allowed connections, and policy violations
- VPN and remote access logs: Records of who connected remotely, from where, and when
- A log aggregation tool: Something that collects logs from all sources into one place where they can be searched and alerted on — Microsoft Sentinel, a SIEM, or even a managed service
Part 1: Windows Event IDs — The Specific Events That Matter
Windows generates thousands of event log entries every day. Most of them are noise — routine system operations that have no security significance. The key to useful Windows security logging is knowing which Event IDs to focus on. These are the events that security researchers and incident responders look for when investigating attacks — and the ones you should be alerting on.
Authentication and Account Events (The Most Critical Category)
| Event ID | Event Name | Why It Matters | Alert Priority |
|---|---|---|---|
| 4624 | Successful logon | Baseline for normal activity; anomalies indicate compromise | Medium (alert on unusual patterns) |
| 4625 | Failed logon | Multiple failures = brute-force attack in progress | HIGH — alert on 5+ failures in 5 minutes |
| 4648 | Logon using explicit credentials | Used by attackers for lateral movement (pass-the-hash, pass-the-ticket) | HIGH — alert on non-admin accounts |
| 4672 | Special privileges assigned to new logon | Admin-level access granted; should be rare and expected | HIGH — alert on unexpected accounts |
| 4720 | User account created | New accounts created outside normal HR process = attacker persistence | HIGH — alert immediately |
| 4722 | User account enabled | Disabled accounts re-enabled; may indicate attacker reactivating dormant accounts | HIGH — alert immediately |
| 4723 | Password change attempt | Normal activity, but unusual timing or frequency warrants review | Medium |
| 4724 | Password reset attempt | Admin resetting passwords; verify it matches expected IT activity | Medium |
| 4728 | Member added to security-enabled global group | Adding accounts to privileged groups = privilege escalation | HIGH — alert on Domain Admins, Administrators |
| 4732 | Member added to security-enabled local group | Local privilege escalation | HIGH — alert on Administrators group |
| 4740 | User account locked out | Repeated failed logins triggered lockout; may indicate brute-force | HIGH — alert immediately |
| 4756 | Member added to security-enabled universal group | Universal group membership changes | HIGH — alert on privileged groups |
Critical Windows Authentication Event IDs for security monitoring. Alert thresholds should be adjusted based on your normal baseline activity.
Process and Command Execution Events
| Event ID | Event Name | Why It Matters | Alert Priority |
|---|---|---|---|
| 4688 | Process creation | Records every process started; essential for detecting malware execution | HIGH — alert on suspicious processes |
| 4689 | Process termination | Paired with 4688 for process lifecycle tracking | Low |
| 4698 | Scheduled task created | Attackers create scheduled tasks for persistence | HIGH — alert on new tasks |
| 4702 | Scheduled task updated | Existing tasks modified; may indicate attacker modifying persistence mechanism | HIGH |
| 7045 | New service installed | Attackers install services for persistence and privilege escalation | HIGH — alert immediately |
| 7036 | Service state changed | Services starting/stopping; unusual service activity warrants review | Medium |
Process and execution Event IDs. Event 4688 requires enabling "Audit Process Creation" in Group Policy and enabling command line logging for maximum value.
Critical configuration: Event ID 4688 (Process Creation) is only useful if you also enable command line logging. Without it, you see that a process was created but not what command was run. Enable this in Group Policy: Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Detailed Tracking → Audit Process Creation → Enable "Include command line in process creation events."
Object Access and File System Events
| Event ID | Event Name | Why It Matters | Alert Priority |
|---|---|---|---|
| 4663 | Object access attempt | File, folder, or registry access; requires object-level auditing enabled | Medium — alert on sensitive directories |
| 4656 | Handle to object requested | Pre-cursor to file access; useful for detecting reconnaissance | Low |
| 4660 | Object deleted | File deletion; ransomware deletes shadow copies and backups | HIGH — alert on backup directories |
| 4670 | Object permissions changed | ACL changes on files or folders; may indicate attacker covering tracks | HIGH — alert on sensitive objects |
Object access events require enabling auditing on specific files and folders through their Properties → Security → Advanced → Auditing settings.
Network and Firewall Events
| Event ID | Event Name | Why It Matters | Alert Priority |
|---|---|---|---|
| 5156 | Windows Filtering Platform connection allowed | Network connection permitted; baseline for normal traffic | Low (alert on unusual destinations) |
| 5157 | Windows Filtering Platform connection blocked | Connection blocked by Windows Firewall | Medium — alert on repeated blocks from same source |
| 5158 | Windows Filtering Platform bind to local port | Application binding to a port; unusual bindings may indicate malware | Medium |
| 4946 | Windows Firewall rule added | New firewall rule created; attackers add rules to allow their traffic | HIGH — alert immediately |
| 4947 | Windows Firewall rule modified | Existing rule changed; may indicate attacker modifying firewall to allow access | HIGH |
| 4950 | Windows Firewall setting changed | Firewall settings modified; disabling firewall is a major red flag | HIGH — alert immediately |
Network and firewall Event IDs. Event 5156/5157 requires enabling Windows Filtering Platform auditing in Advanced Audit Policy.
System and Policy Events
| Event ID | Event Name | Why It Matters | Alert Priority |
|---|---|---|---|
| 1102 | Audit log cleared | Someone cleared the Security event log; major red flag — attackers do this to cover tracks | CRITICAL — alert immediately |
| 4719 | System audit policy changed | Audit policy modified; attackers disable auditing to avoid detection | CRITICAL — alert immediately |
| 4697 | Service installed in the system | New service installed; attackers use services for persistence | HIGH — alert immediately |
| 4616 | System time changed | System clock changed; may indicate attempt to confuse log timestamps | HIGH |
| 4657 | Registry value modified | Registry changes; attackers modify registry for persistence and configuration | HIGH — alert on Run keys and security settings |
| 4698 | Scheduled task created | New scheduled task; common attacker persistence mechanism | HIGH — alert immediately |
System and policy Event IDs. Events 1102 and 4719 are the most critical — they indicate an attacker actively trying to cover their tracks.
How to Enable Advanced Audit Policy in Windows
By default, Windows does not log all of the events listed above. You need to enable Advanced Audit Policy to capture the full set of security-relevant events. This is done through Group Policy (for domain-joined computers) or Local Security Policy (for standalone computers).
- 1For domain-joined computers: Open Group Policy Management (gpmc.msc) on your domain controller. Create or edit a GPO that applies to all computers. Navigate to: Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies.
- 2For standalone computers: Press Windows key + R, type secpol.msc, press Enter. Navigate to: Security Settings → Advanced Audit Policy Configuration → Audit Policies.
- 3Enable the following audit categories: Account Logon (Credential Validation — Success and Failure), Account Management (User Account Management — Success and Failure; Security Group Management — Success), Detailed Tracking (Process Creation — Success; enable command line logging separately), Logon/Logoff (Logon — Success and Failure; Special Logon — Success), Object Access (File System — Success and Failure for sensitive directories; Filtering Platform Connection — Success and Failure), Policy Change (Audit Policy Change — Success and Failure; Authentication Policy Change — Success), Privilege Use (Sensitive Privilege Use — Success and Failure), System (Security State Change — Success; Security System Extension — Success; System Integrity — Success and Failure).
- 4Apply the policy: Run gpupdate /force on client machines or wait for the next Group Policy refresh.
- 5Increase the Security event log size: By default, the Security log is limited to 20MB — it fills up quickly with advanced auditing enabled. Increase it to at least 512MB. In Group Policy: Computer Configuration → Windows Settings → Security Settings → Event Log → Maximum security log size → set to 524288 KB (512MB).
Pro Tip
Start with the most critical events: If enabling full advanced auditing feels overwhelming, start with just these four categories: Account Management (catches new accounts and group changes), Logon/Logoff (catches authentication events), Policy Change (catches audit policy tampering), and System (catches log clearing). These four categories catch the most common attacker actions and generate manageable log volume.
Part 2: Microsoft 365 Unified Audit Log — Cloud Activity Logging
If your business uses Microsoft 365, the Unified Audit Log is one of the most valuable security data sources available to you. It records all user and administrator activity across Exchange Online, SharePoint, OneDrive, Teams, Azure AD, and other Microsoft 365 services. By default, it is enabled for most Microsoft 365 plans — but many businesses never look at it.
Enabling and Accessing the Unified Audit Log
- 1Verify audit logging is enabled: Sign in to the Microsoft Purview compliance portal at compliance.microsoft.com. Navigate to Audit → Audit search. If you see a message saying "Start recording user and admin activity," click it to enable auditing. If you see the search interface, auditing is already enabled.
- 2Set the audit log retention period: By default, audit logs are retained for 90 days (Microsoft 365 Business plans) or 180 days (E3/E5 plans). For compliance purposes, consider upgrading to Microsoft 365 E5 or adding the Microsoft 365 E5 Compliance add-on for 1-year or 10-year retention.
- 3Access audit logs: Navigate to compliance.microsoft.com → Audit → Audit search. You can search by date range, user, activity type, and other filters.
- 4Export logs for analysis: Click Export to download audit log data as a CSV file for analysis in Excel or a SIEM tool.
Critical Microsoft 365 Activities to Monitor
| Activity | Category | Why It Matters | Alert Priority |
|---|---|---|---|
| UserLoggedIn | Azure AD | Successful sign-in; baseline for normal activity | Medium (alert on unusual locations) |
| UserLoginFailed | Azure AD | Failed sign-in; multiple failures = brute-force | HIGH — alert on 5+ failures |
| Add member to role | Azure AD | Admin role assigned; privilege escalation | CRITICAL — alert immediately |
| Set domain authentication | Azure AD | Domain federation changed; may indicate account takeover setup | CRITICAL |
| MailboxLogin | Exchange | Mailbox accessed; unusual access patterns may indicate compromise | HIGH — alert on unusual locations |
| New-InboxRule | Exchange | Email forwarding rule created; attackers set these up to receive copies of emails | CRITICAL — alert immediately |
| Set-Mailbox | Exchange | Mailbox settings changed; may include adding forwarding addresses | HIGH |
| FileDownloaded | SharePoint/OneDrive | File downloaded; mass downloads may indicate data exfiltration | HIGH — alert on bulk downloads |
| FileDeleted | SharePoint/OneDrive | File deleted; may indicate data destruction or ransomware | HIGH — alert on bulk deletions |
| SharingInvitationCreated | SharePoint | External sharing enabled; sensitive files shared externally | HIGH — alert on sensitive directories |
| Add-MailboxPermission | Exchange | Full access to mailbox granted; may indicate attacker adding persistent access | CRITICAL |
| Disable-AntiPhishPolicy | Exchange | Anti-phishing policy disabled; attacker removing security controls | CRITICAL |
Critical Microsoft 365 Unified Audit Log activities for security monitoring. The New-InboxRule and Add member to role activities are the most commonly exploited in Business Email Compromise attacks.
The New-InboxRule alert is the most important Microsoft 365 security alert for small businesses. When an attacker compromises an email account, the first thing they do is create an inbox rule to forward all emails to an external address — so they continue receiving emails even after the password is changed. Alert on every New-InboxRule event, immediately, with no exceptions.
Setting Up Microsoft 365 Alerts in the Compliance Portal
- 1Navigate to compliance.microsoft.com → Policies → Alert policies.
- 2Click New alert policy.
- 3For the New-InboxRule alert: Name it "New Email Forwarding Rule Created." Set Activity to "New-InboxRule." Set Severity to High. Set notification to send email to your IT administrator immediately. Click Save.
- 4For the Admin role assignment alert: Name it "Admin Role Assigned." Set Activity to "Add member to role." Set Severity to Critical. Set notification to send email immediately. Click Save.
- 5For the bulk file download alert: Name it "Bulk File Download Detected." Set Activity to "FileDownloaded." Set the threshold to alert when more than 50 files are downloaded in 10 minutes. Set Severity to High. Click Save.
- 6Review the default alert policies: Microsoft 365 includes several default alert policies for common security events. Navigate to Alert policies and review the existing policies — ensure they are enabled and configured to notify the right people.
Part 3: Microsoft Sentinel — Setting Up a SIEM for Small Business
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) platform that collects logs from Windows computers, Microsoft 365, Azure, and hundreds of other sources, then uses AI and analytics to detect threats and generate alerts. It is the most accessible enterprise-grade SIEM for small businesses because it integrates natively with Microsoft 365 and charges based on data ingestion volume — making it affordable for organizations that start with a focused set of log sources.
Microsoft Sentinel Pricing: What It Actually Costs for a Small Business
Sentinel charges $2.46 per GB of data ingested (pay-as-you-go pricing as of 2025). For a 20-person business ingesting Windows Security logs, Microsoft 365 audit logs, and firewall logs, typical monthly ingestion is 5–15 GB — costing $12–$37 per month. This is dramatically less expensive than traditional SIEM platforms, which typically cost $10,000–$50,000 per year for small business deployments.
- Free data sources: Microsoft 365 Defender, Microsoft Entra ID, and Microsoft Defender for Cloud data is ingested into Sentinel at no additional charge
- Paid data sources: Windows Security Events, firewall logs, and other non-Microsoft sources are charged at $2.46/GB
- Commitment tiers: If you ingest more than 100 GB/day, commitment pricing reduces the per-GB cost significantly
- Log Analytics workspace: Sentinel runs on top of Azure Log Analytics, which has its own pricing — factor this into your cost estimate
- Estimated monthly cost for a 20-person business: $15–$50/month for basic Windows + Microsoft 365 logging
Step-by-Step Microsoft Sentinel Setup
- 1If you do not have an Azure subscription, create one at portal.azure.com. You will need a credit card for billing, but you can start with the free tier.
- 2In the Azure portal, search for "Log Analytics workspaces" and click Create.
- 3Select your subscription, create or select a resource group (e.g., "SecurityMonitoring"), give the workspace a name (e.g., "YourCompany-Security"), select a region (East US or the region closest to your business), and click Review + Create → Create.
- 4Wait for the workspace to be created (typically 1–2 minutes).
- 1In the Azure portal, search for "Microsoft Sentinel" and click Create.
- 2Select the Log Analytics workspace you just created and click Add.
- 3Microsoft Sentinel will be enabled on your workspace. This takes 1–2 minutes.
- 4You will be taken to the Microsoft Sentinel overview page. This is your security operations dashboard.
- 1In Microsoft Sentinel, navigate to Configuration → Data connectors.
- 2Search for "Microsoft 365 Defender" and click Open connector page. Click Connect. This ingests alerts and incidents from Microsoft Defender for Endpoint, Defender for Office 365, and Defender for Identity at no additional charge.
- 3Search for "Microsoft Entra ID" and click Open connector page. Select the log types you want to ingest: Sign-in logs (captures all Azure AD sign-ins), Audit logs (captures all Azure AD admin activity), and Risky sign-ins (captures sign-ins flagged as risky by Entra ID Protection). Click Connect.
- 4Search for "Office 365" and click Open connector page. Select Exchange, SharePoint, and Teams. Click Connect. This ingests the Microsoft 365 Unified Audit Log into Sentinel.
- 5Wait 15–30 minutes for data to start flowing. Navigate to Logs and run a simple query to verify data is arriving: AuditLogs | take 10
- 1In Data connectors, search for "Windows Security Events via AMA" and click Open connector page.
- 2Click Create data collection rule.
- 3Name the rule (e.g., "Windows-Security-Events"), select your subscription and resource group.
- 4Under Resources, add the Windows computers you want to monitor. For Azure VMs, select them directly. For on-premises computers, you will need to install the Azure Monitor Agent (AMA) — see Step 5.
- 5Under Collect, select which events to collect: Common (recommended for most businesses — includes the critical Event IDs listed in Part 1), All Security Events (more comprehensive but higher cost), or Minimal (only the most critical events — lowest cost).
- 6Click Create. The data collection rule will be applied to the selected computers.
For Windows computers that are not Azure VMs (most small business computers), you need to install the Azure Monitor Agent to send logs to Sentinel.
- 1In the Azure portal, navigate to Monitor → Data Collection Rules → select your rule → Resources → Add.
- 2For on-premises computers, you need to first onboard them to Azure Arc. Navigate to Azure Arc → Machines → Add/Create → Add a machine.
- 3Follow the Azure Arc onboarding wizard to generate an installation script.
- 4Run the installation script on each Windows computer you want to monitor. The script installs the Azure Connected Machine agent and registers the computer with Azure Arc.
- 5Once registered, the computer will appear in your Data Collection Rule resources and will begin sending logs to Sentinel.
- 6Alternative for Microsoft 365 Business Premium users: If your computers are enrolled in Microsoft Intune, you can deploy the Azure Monitor Agent through Intune without manually running scripts on each computer.
Most business-grade firewalls can send logs to Sentinel via Syslog or CEF (Common Event Format). The exact configuration depends on your firewall vendor.
- Fortinet FortiGate: In Data connectors, search for "Fortinet FortiGate Next-Generation Firewall." Follow the connector instructions to configure Syslog forwarding from your FortiGate to a log forwarder VM.
- Cisco Meraki: Search for "Cisco Meraki" in Data connectors. Configure Syslog export in the Meraki Dashboard under Network-wide → General → Reporting.
- SonicWall: Search for "SonicWall Firewall" in Data connectors. Configure Syslog in the SonicWall admin interface under Log → Syslog.
- Palo Alto: Search for "Palo Alto Networks" in Data connectors. Configure log forwarding in Panorama or the firewall's log forwarding profile.
- Note: Firewall log ingestion requires a log forwarder — a Linux VM that receives Syslog from the firewall and forwards it to Sentinel. This adds some complexity and cost (~$15–30/month for a small Azure VM).
Part 4: Configuring Analytics Rules — The Alerts That Catch Real Attacks
Collecting logs is only half the work. The other half is configuring analytics rules — automated queries that run continuously against your log data and generate alerts when they detect suspicious patterns. Microsoft Sentinel includes hundreds of built-in analytics rules based on real-world attack patterns. Here are the ones to enable first.
Enabling Built-In Analytics Rules in Microsoft Sentinel
- 1In Microsoft Sentinel, navigate to Configuration → Analytics.
- 2Click Rule templates to see all available built-in rules.
- 3Filter by Status: Not enabled to see rules that are available but not yet active.
- 4For each rule you want to enable, click the rule name to review it, then click Create rule to enable it with the default configuration.
- 5Review the rule settings: alert name, description, severity, query, and alert threshold. Adjust as needed for your environment.
- 6Click Review + Create → Create to enable the rule.
Priority Analytics Rules to Enable First
| Rule Name | Category | What It Detects | Severity |
|---|---|---|---|
| Brute force attack against Azure AD | Identity | Multiple failed Azure AD sign-ins from same IP | High |
| Successful logon from IP and failure from a different IP | Identity | Credential stuffing — successful login after failures from different IPs | Medium |
| Anomalous sign-in location | Identity | Sign-in from a location inconsistent with user's history | High |
| Impossible travel activity | Identity | Sign-ins from two geographically distant locations within impossible timeframe | High |
| New admin account created and used | Identity | New admin account created and immediately used | High |
| Mailbox forwarding rule created | Exchange | New email forwarding rule — top BEC indicator | High |
| Mass download from SharePoint | SharePoint | Bulk file download — potential data exfiltration | High |
| Rare subscription-level operations in Azure | Azure | Unusual Azure admin operations — may indicate account compromise | Medium |
| Security event log cleared | Windows | Event log cleared — attacker covering tracks | Critical |
| New process created with suspicious command line | Windows | Process creation with known malicious command patterns | High |
| Scheduled task created or modified | Windows | New scheduled task — common attacker persistence mechanism | High |
| User added to privileged group | Windows/Azure AD | Privilege escalation — user added to admin group | High |
| Potential ransomware activity | Windows | File encryption patterns consistent with ransomware | Critical |
| Suspicious PowerShell command line | Windows | PowerShell with encoded commands or known malicious patterns | High |
| Network connection to known malicious IP | Network | Outbound connection to threat intelligence-flagged IP | High |
Priority Microsoft Sentinel analytics rules for small business security monitoring. Enable all Critical and High severity rules immediately.
Creating Custom Analytics Rules for Your Environment
In addition to built-in rules, you can create custom rules using Kusto Query Language (KQL) — Sentinel's query language. Here are three custom rules that are particularly valuable for Miami small businesses.
This rule alerts on any new inbox rule that forwards or redirects email to an external address — the most common Business Email Compromise persistence technique.
- In Sentinel → Analytics → Create → Scheduled query rule
- Name: "External Email Forwarding Rule Created"
- Severity: High
- Query: OfficeActivity | where Operation == "New-InboxRule" | where Parameters has "ForwardTo" or Parameters has "RedirectTo" | where Parameters !contains "@yourcompany.com" | project TimeGenerated, UserId, Parameters, ClientIP
- Run query every: 5 minutes
- Lookup data from last: 5 minutes
- Alert threshold: Generate alert when number of results is greater than 0
- Replace @yourcompany.com with your actual domain
This rule detects when a user signs in from two geographically distant locations within a timeframe that would be physically impossible — a strong indicator of account compromise.
- In Sentinel → Analytics → Create → Scheduled query rule
- Name: "Impossible Travel Detected"
- Severity: High
- Query: SigninLogs | where ResultType == 0 | summarize Locations = make_set(Location), IPAddresses = make_set(IPAddress), Count = count() by UserPrincipalName, bin(TimeGenerated, 1h) | where array_length(Locations) > 1 | project TimeGenerated, UserPrincipalName, Locations, IPAddresses
- Run query every: 1 hour
- Lookup data from last: 2 hours
- Alert threshold: Generate alert when number of results is greater than 0
This rule alerts when administrative actions are performed outside of normal business hours — a common indicator of attacker activity using compromised admin credentials.
- In Sentinel → Analytics → Create → Scheduled query rule
- Name: "After-Hours Administrative Activity"
- Severity: Medium
- Query: AuditLogs | where TimeGenerated between (datetime_add("hour", -6, now()) .. now()) | where hourofday(TimeGenerated) !between (8 .. 18) | where Category == "RoleManagement" or Category == "UserManagement" | where Result == "success" | project TimeGenerated, InitiatedBy, OperationName, TargetResources
- Run query every: 1 hour
- Lookup data from last: 1 hour
- Alert threshold: Generate alert when number of results is greater than 0
- Adjust the hours (8 to 18) to match your normal business hours
Part 5: SIEM Alternatives to Microsoft Sentinel
Microsoft Sentinel is the best option for businesses already using Microsoft 365 and Azure, but it is not the only option. Here are the main alternatives for Miami small businesses.
Huntress (huntress.com) — Best Managed Option for SMBs
Huntress is a managed detection and response (MDR) platform specifically designed for small and mid-size businesses. Rather than requiring you to configure and monitor a SIEM yourself, Huntress provides 24/7 human-reviewed threat detection and response. Their Security Operations Center (SOC) reviews every alert and only escalates to you when action is required — eliminating alert fatigue.
- Coverage: Endpoint detection (Windows and macOS), Microsoft 365 monitoring, and identity threat detection
- Key feature: Human-reviewed alerts — every alert is reviewed by a Huntress SOC analyst before you are notified, dramatically reducing false positives
- Pricing: Approximately $10–15/endpoint/month
- Best for: Small businesses that want 24/7 monitoring without the overhead of managing a SIEM
- Setup complexity: Low — install the Huntress agent on each computer and connect your Microsoft 365 tenant
Elastic SIEM (elastic.co) — Best Open-Source Option
Elastic SIEM is an open-source SIEM built on the Elastic Stack (Elasticsearch, Logstash, Kibana). It is free to self-host and provides powerful log analysis and threat detection capabilities. The trade-off is higher setup complexity and ongoing maintenance requirements.
- Coverage: Any log source that can be forwarded via Syslog, Beats agents, or API
- Pricing: Free for self-hosted; Elastic Cloud starts at $95/month for managed hosting
- Best for: Businesses with technical IT staff who want maximum flexibility and control at minimal cost
- Setup complexity: High — requires Linux server administration knowledge
Splunk (splunk.com) — Enterprise Option
Splunk is the industry-leading SIEM platform used by large enterprises. It is powerful but expensive — typically $10,000–$50,000 per year for small business deployments. Splunk Free allows up to 500MB/day of data ingestion at no cost, which may be sufficient for very small businesses with limited log sources.
- Coverage: Any log source; thousands of pre-built integrations
- Pricing: Splunk Free (500MB/day limit); Splunk Cloud starts at approximately $2,000/month for small deployments
- Best for: Businesses that need enterprise-grade SIEM capabilities and have the budget and technical staff to support it
- Setup complexity: High
Managed Security Service Provider (MSSP) — Best for Businesses Without IT Staff
For businesses without dedicated IT or security staff, the most practical option is to engage a managed security service provider (MSSP) that provides 24/7 monitoring as a service. The MSSP deploys and manages the SIEM, monitors alerts around the clock, and contacts you when action is required.
- Coverage: Varies by provider — ask specifically what log sources are monitored and what the alert response process is
- Pricing: Typically $2,000–$8,000/month for small business MSSP services
- Best for: Businesses that want comprehensive 24/7 monitoring without any internal security expertise
- Simple Network Solutions provides managed security monitoring for Miami businesses as part of our Comprehensive managed IT tier
Part 6: Building Your Alert Response Workflow
Alerts are only valuable if you respond to them correctly and quickly. An alert that sits in an inbox for 48 hours while an attacker completes their operation is worse than no monitoring — it creates a false sense of security. Build your alert response workflow before you need it.
Alert Severity Tiers and Response Times
| Severity | Examples | Response Time | Initial Actions |
|---|---|---|---|
| Critical | Log cleared, ransomware activity, admin role assigned unexpectedly | Immediate (within 15 minutes) | Isolate affected systems, escalate to IT provider, begin incident response |
| High | Brute-force attack, impossible travel, new forwarding rule, bulk download | Within 1 hour | Investigate sign-in logs, verify with affected user, reset credentials if suspicious |
| Medium | After-hours admin activity, new scheduled task, unusual process | Within 4 hours | Review context, determine if expected activity, document finding |
| Low | Single failed login, routine policy change | Within 24 hours | Review in daily log review, document if pattern emerges |
| Informational | Successful logins, normal file access | Weekly review | Review for anomalies in weekly security review |
Alert severity tiers and response time targets for a Miami small business security monitoring program.
The Critical Alert Response Checklist
For Critical severity alerts — log cleared, ransomware activity, unexpected admin role assignment — follow this checklist immediately:
- 1Do not panic, but act immediately: Critical alerts require immediate action, not deliberation. Start the checklist now.
- 2Isolate the affected system: If the alert involves a specific computer (ransomware activity, suspicious process), disconnect it from the network immediately. Unplug the network cable or disable Wi-Fi. Do not power it off — forensic evidence is preserved in memory.
- 3Preserve evidence: Take screenshots of the alert details, the affected system's screen, and any visible indicators of compromise. Do not delete or modify anything.
- 4Contact your IT provider: Call your managed IT provider immediately. Do not email — if your email is compromised, the attacker may see your communications. Have your IT provider's emergency phone number saved in your phone.
- 5Assess the scope: While waiting for your IT provider, review the alert details to understand what happened, when it started, and what systems may be affected.
- 6Do not pay ransom without consultation: If ransomware is involved, do not pay ransom without consulting your IT provider and legal counsel. Payment may violate OFAC sanctions if the attacker is on a sanctions list.
- 7Notify your cyber insurance carrier: Most cyber insurance policies require prompt notification of incidents. Call your carrier immediately.
- 8Document everything: Record the timeline of events, actions taken, and communications. This documentation is required for insurance claims and compliance reporting.
The Daily Security Review Process
In addition to automated alerts, establish a daily 15-minute security review process. This catches patterns that individual alerts might miss and builds institutional knowledge about your environment's normal behavior.
- Review all Medium and Low alerts from the past 24 hours in Sentinel or your SIEM
- Check the Microsoft 365 admin center for any new alerts or unusual activity
- Review the Risky users report in Microsoft Entra ID Protection
- Check firewall logs for any unusual traffic patterns or repeated blocked connections
- Review the list of connected devices on your network for any unrecognized devices
- Document any findings and actions taken
Part 7: Logging for Compliance — HIPAA, PCI DSS, and FTC Safeguards
For Miami businesses in regulated industries, security logging is not just a security best practice — it is a compliance requirement. Here is what each major regulation requires.
HIPAA Security Rule Logging Requirements
HIPAA's Security Rule (45 CFR § 164.312) requires covered entities to implement hardware, software, and procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information (ePHI). Specific requirements include:
- Audit controls (Required): Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI
- Activity review (Addressable): Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports
- Log retention: HIPAA does not specify a log retention period, but the general HIPAA documentation retention requirement is 6 years — apply this to security logs
- What to log: All access to ePHI systems, authentication events, privilege use, and system configuration changes
- Practical implementation: Enable Windows Security Event logging on all systems containing ePHI, enable Microsoft 365 Unified Audit Log, and retain logs for at least 6 years using Sentinel or a log archiving solution
PCI DSS Logging Requirements
PCI DSS Requirement 10 specifically addresses audit logging for cardholder data environments:
- Requirement 10.2: Implement audit trails to reconstruct events — log all individual user access to cardholder data, all actions taken by root or administrative users, access to all audit trails, invalid logical access attempts, use of identification and authentication mechanisms, initialization/stopping/pausing of audit logs, and creation/deletion of system-level objects
- Requirement 10.3: Record at least the following audit trail entries for all system components: user identification, type of event, date and time, success or failure indication, origination of event, and identity or name of affected data, system component, or resource
- Requirement 10.5: Secure audit trails so they cannot be altered — use write-once media or a centralized log management system
- Requirement 10.7: Retain audit trail history for at least one year, with a minimum of three months immediately available for analysis
- Practical implementation: Microsoft Sentinel with 1-year retention satisfies most PCI DSS logging requirements for small merchants
FTC Safeguards Rule Logging Requirements
The updated FTC Safeguards Rule (16 CFR Part 314) requires non-bank financial institutions to implement a written information security program that includes monitoring and testing. Specific logging requirements include:
- Continuous monitoring or periodic penetration testing and vulnerability assessments
- Monitoring and testing of the effectiveness of key controls, systems, and procedures
- Audit trails designed to detect and respond to security events
- Procedures for detecting actual and attempted attacks on or intrusions into information systems
- Practical implementation: Microsoft Sentinel with the analytics rules described in Part 4 satisfies the monitoring requirements of the FTC Safeguards Rule
Part 8: Log Retention — How Long to Keep Logs
Log retention is a balance between security value (longer retention means more historical data for investigations), compliance requirements (regulations specify minimum retention periods), and cost (longer retention means more storage). Here are the recommended retention periods for each log type.
| Log Type | Minimum Retention | Recommended Retention | Compliance Driver |
|---|---|---|---|
| Windows Security Event Logs | 90 days | 1 year | PCI DSS (1 year), HIPAA (6 years for ePHI systems) |
| Microsoft 365 Unified Audit Log | 90 days (default) | 1 year | PCI DSS, FTC Safeguards Rule |
| Azure AD Sign-in Logs | 30 days (default) | 1 year | General security best practice |
| Firewall Logs | 30 days | 1 year | PCI DSS, general security best practice |
| VPN Access Logs | 30 days | 1 year | General security best practice |
| Email Logs | 90 days | 1 year | Legal hold, compliance investigations |
| Cloud Storage Access Logs | 30 days | 1 year | HIPAA (for ePHI), PCI DSS |
Recommended log retention periods for Miami small businesses. Businesses with HIPAA obligations should retain logs for 6 years for systems containing ePHI.
Configuring Log Retention in Microsoft Sentinel
- 1In the Azure portal, navigate to your Log Analytics workspace.
- 2Click Usage and estimated costs → Data Retention.
- 3Set the retention period to your desired value (30–730 days for standard retention; up to 7 years with archive tier).
- 4For compliance-driven retention beyond 2 years: Enable the Archive tier in Log Analytics, which stores data at a lower cost ($0.02/GB/month vs. $0.12/GB/month for interactive retention).
- 5For Microsoft 365 Unified Audit Log retention: In the Microsoft Purview compliance portal, navigate to Audit → Audit retention policies. Create a policy to retain specific activity types for up to 10 years (requires Microsoft 365 E5 Compliance or Microsoft 365 E5 add-on).
Part 9: Practical Implementation Timeline for Miami Small Businesses
Setting up a complete security logging and monitoring program takes time. Here is a realistic implementation timeline that balances security improvement with operational disruption.
Week 1: Enable Free Logging (Zero Cost)
- Enable Microsoft 365 Unified Audit Log (if not already enabled)
- Enable Microsoft Entra ID Protection (if you have Microsoft 365 Business Premium)
- Configure Microsoft 365 alert policies for New-InboxRule and Admin role assignment
- Enable Windows Security Event logging on all computers using Group Policy or Local Security Policy
- Increase Windows Security Event log size to 512MB on all computers
Week 2: Set Up Microsoft Sentinel (Low Cost)
- Create Azure subscription and Log Analytics workspace
- Enable Microsoft Sentinel
- Connect Microsoft 365 Defender, Entra ID, and Office 365 data connectors (free)
- Enable the priority analytics rules from Part 4
- Configure alert notifications to reach your IT administrator
Week 3: Connect Windows Endpoints
- Install Azure Monitor Agent on Windows computers (via Intune or manual installation)
- Configure Windows Security Events data collection rule
- Verify Windows events are flowing into Sentinel
- Enable Windows-specific analytics rules (process creation, scheduled tasks, log clearing)
- Create custom analytics rules for your environment
Week 4: Connect Firewall and Finalize
- Configure firewall Syslog forwarding to Sentinel (if applicable)
- Connect VPN logs
- Configure log retention policies
- Document your alert response workflow
- Brief your team on the monitoring program and alert response procedures
- Conduct a test: generate a test alert (e.g., multiple failed logins) and verify the alert fires and the response workflow works
Common Mistakes to Avoid
- Collecting logs but never reviewing them: Logs without review are just storage costs. Establish a daily review process and automated alerts before you start collecting.
- Alert fatigue: Too many low-quality alerts cause teams to ignore all alerts. Start with a small set of high-confidence, high-severity rules and expand gradually.
- Not testing your alerts: Configure a test scenario (multiple failed logins, a new inbox rule) and verify your alerts fire correctly before relying on them for real incidents.
- Forgetting to monitor cloud services: Most small businesses focus on Windows endpoint logging and forget that Microsoft 365, Azure, and other cloud services generate equally important security events.
- Not securing the logs themselves: Logs are only useful if they cannot be tampered with. Use a centralized log management system (Sentinel) rather than relying on local Windows event logs that an attacker can clear.
- Skipping log retention planning: Discovering you need 6 months of logs for an investigation and only having 30 days is a painful lesson. Plan retention before you need it.
- Not documenting your baseline: You cannot detect anomalies without knowing what normal looks like. Spend the first two weeks after enabling logging reviewing what normal activity looks like in your environment before tuning your alert thresholds.
Getting Professional Help: Managed Security Monitoring for Miami Businesses
Setting up and maintaining a security logging and monitoring program requires ongoing attention — reviewing alerts, tuning rules, investigating incidents, and keeping up with new threat patterns. For most Miami small businesses, the most practical approach is to engage a managed IT provider that includes security monitoring as part of their service.
Simple Network Solutions provides managed security monitoring for Miami businesses as part of our Comprehensive managed IT tier. We deploy and manage Microsoft Sentinel, configure analytics rules based on current threat intelligence, monitor alerts 24/7, and respond to incidents on your behalf. Our security team includes CISSP and CEH certified specialists who have responded to over 200 security incidents for Miami-Dade businesses.
What Our Managed Security Monitoring Includes
- Microsoft Sentinel deployment and configuration: We set up and manage your Sentinel workspace, connect all relevant data sources, and configure analytics rules based on current threat intelligence
- Windows endpoint logging: We deploy Azure Monitor Agent to all managed computers and configure Windows Security Event collection
- Microsoft 365 monitoring: We connect and monitor your Microsoft 365 Unified Audit Log, Entra ID sign-in logs, and Defender alerts
- Firewall log integration: We connect your firewall logs to Sentinel for network-level visibility
- 24/7 alert monitoring: Our security team monitors all Critical and High severity alerts around the clock and contacts you within 15 minutes of a Critical alert
- Monthly security reports: We provide monthly reports summarizing security events, alert trends, and recommendations
- Incident response support: When an incident is detected, we provide immediate response support including system isolation, forensic investigation, and remediation guidance
Pro Tip
Start with a free firewall audit to understand your complete security posture before investing in logging and monitoring infrastructure. The audit includes an assessment of your current logging capabilities and recommendations for the most impactful improvements. Visit simplenetworksolutions.com/firewall-audit or call (786) 383-2066.
Stay ahead of Miami's IT threats & trends
Monthly insights written for South Florida business owners — covering cybersecurity alerts, cost-saving IT strategies, and Miami-specific technology advice.
About the Author
Senior Cybersecurity Specialist · 14 years experience
CISSP · CEH · CompTIA Security+ · CISM · 14 Years Experience
Marco leads cybersecurity operations at Simple Network Solutions, with 14 years of experience in network security, penetration testing, and compliance for regulated industries. He has responded to over 200 security incidents for Miami businesses and holds four active cybersecurity certifications. He regularly presents at South Florida IT security events and contributes to the FBI InfraGard Miami chapter.