More data, same uncertainty
It is easy to believe that better security starts with collecting more logs. Then the SIEM fills up, storage costs rise, and analysts still cannot answer the basic question: what happened? A log records an observation from one system. An incident is a connected explanation built from many observations. The distance between those two is context.
The context that changes a verdict
A failed login is ordinary until it targets a privileged account from a new country five minutes after an MFA reset. A large download may be normal for a backup server and alarming for an intern's laptop. Useful enrichment includes identity role, asset criticality, device owner, location history, vulnerability exposure, and recent changes. None of these signals proves malicious activity alone, but together they change how an analyst prioritizes the event.
Build context deliberately
Start with a small set of reliable fields rather than connecting every data source at once. Normalize identities, maintain an asset inventory, synchronize time, and preserve the original event. Then create detections that explain which context affected the outcome. If a rule assigns high severity because the account is privileged, show that reason. Explainability helps analysts validate the alert and helps engineers find bad assumptions.
The practical takeaway
Logging strategy should begin with investigation questions, not vendor checklists. Ask what evidence would be needed to confirm account compromise, lateral movement, or data loss. Collect and retain data that answers those questions. More telemetry can help, but only when the system can connect it to people, assets, and expected behavior.