Is there a best practice recommendation around log sources that should be part of log retention?

Each compliance or best practices framework has its own requirements, but sometimes they can be vague. It is important to speak to your auditor where there is mandated adherence, to ensure you’re retaining the correct log types. In general, the requirements are to store logs which may help identify anomalous activity, logins, and access, which obviously can cover a wide breadth of tools. Because Field Effect offers a comprehensive monitoring solution including endpoint, network, and cloud data, the data collected by Field Effect, and alerts generated through this monitoring, provide a robust view into activity in the environment. 

In order the ‘check the box’ for compliance purposes, though, you may need to consider other tools/systems that generate authentication, authorization, and access logs such as database logs, custom-built application logs, firewall logs, and VPN logs. 

This is not an exhaustive list, and if you have concerns or questions, please contact support@fieldeffect.com if you wish to discuss your requirements.