Logging Made Easy

CISA's Logging Made Easy (LME) is a centralized, no-cost log management and threat detection solution for small to medium-sized organizations with limited resources that would otherwise have little to no functionality to detect attacks. LME offers centralized logging, proactive threat detection and enhanced security by allowing organizations to monitor their network, identify users, and actively analyze Sysmon data to quickly identify potential malicious activity. As a locally run application, CISA cannot access LME data, ensuring the privacy and security of organizations' information.

Leveraging Elastic and Wazuh, LME offers centralized log collection, proactive threat detection, and real-time alerting, enabling organizations to monitor their network and user activity and analyze alerts to detect potential malicious activity. This setup provides comprehensive and customizable logging through filters using open source software, which blends cost-efficiency with robust functionality. The straightforward installation process and adaptable dashboards enhance user-friendliness, while frequent updates maintain its effectiveness and security.

LME is dedicated to evolving with the cybersecurity needs of its community. To get started with LME, download it directly from CISA’s GitHub page. For any questions, please contact CyberSharedServices@mail.cisa.dhs.gov. For more resources, please visit CISA's LME YouTube channel.

Additional Resources:

Best Practices for Event Logging and Threat Detection is a joint guide to help organizations define a baseline for logging best practices to mitigate malicious cyber threats. It provides recommendations that improve an organization’s resilience in the current cyber threat environment, with regard for resourcing constraints. The guidance is of moderate technical complexity and assumes a basic understanding of event logging.

Choosing Secure and Verifiable Technologies is updated joint guidance released by the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), in partnership with CISA, the Canadian Centre for Cyber Security (CCCS), the United Kingdom’s National Cyber Security Centre (NCSC-UK), New Zealand’s National Cyber Security Centre (NCSC-NZ), and the Republic of Korea’s National Intelligence Service (NIS) and NIS’ National Cyber Security Centre (NCSC). The guidance is intended to aid procuring organizations and manufacturers of digital products and services in choosing and developing technology that is secure by design.