Baseline sources
Public documentation, standards, and project material used to organize and classify the baseline.
01
Security domains
Documentation previously linked from each domain in the explorer.
IdentityAuthentication, authorization, accounts, and identity governance.EndpointEndpoint detections, host activity, and vulnerability telemetry.NetworkNetwork security controls, flows, name resolution, and traffic activity.CloudCloud control-plane activity and cloud-native security findings.Email and collaborationMessaging, collaboration, and email security activity.Applications and workloadsApplication, workload, and enterprise platform activity.Data securityData access, storage, databases, and data protection controls.Infrastructure and platformInfrastructure health, configuration, containers, and operational diagnostics.Security operationsAlerts, incidents, posture, and Sentinel platform operations.Threat intelligenceThreat indicators, intelligence objects, and enrichment.
02
Classification methodology
Linked references listed by Log Horizon for its generic classifications. The methodology shows how the value and tier rules apply them.
ACSCBest practices for event logging and threat detectionACSCPriority logs for SIEM ingestionCISAGuidance for Implementing M-21-31CISAMicrosoft Expanded Cloud Logs Implementation PlaybookMicrosoftMicrosoft Sentinel data connectors referenceMicrosoftMicrosoft Sentinel tables and connectors referenceMicrosoftAzure-Sentinel community repositoryMicrosoftMicrosoft Sentinel billingMicrosoftMicrosoft Sentinel data tier managementMITREATT&CK data sourcesNISTSP 800-92 Guide to Computer Security Log ManagementGoogle CloudCloud Audit Logs overviewGoogle CloudCloud Audit Logs best practices
03
Log Horizon
Project repositories and practical articles from the Log Horizon README.