Using logs for forensics after a data breach

08.11.2010

Store normalized logs in database:

* Logs are available in "intelligent" form for easy reporting.

* Difficult/impossible to guarantee their integrity.

* Storage space wasted because of empty fields in database.

Store raw logs in signed flat files: