Security Log Review Checklist Template

Runs every tier. Task 1 is a required DropDown (Daily, Weekly, Monthly, Quarterly) that shows the matching phases and hides the rest.

• Record the tier and the period covered — for a daily review, the previous 24 hours or everything since the last completed review
• Confirm the reviewer is not reviewing their own administrative activity — hand those events to a second reviewer
• Carry forward open exceptions from the previous run — anything still awaiting an answer from a system owner comes first
• Note known changes and maintenance in the period — approved change tickets explain many events that would otherwise look suspicious

Daily tier.

• Check that every critical source sent events in the last 24 hours — identity provider, firewalls, endpoint tool, email, cloud audit logs and in-scope servers
• Investigate any silent or low-volume source — a source that stops reporting is a failed control until proven otherwise
• Check the collection pipeline for errors — ingestion failures, parsing errors, dropped events and storage near capacity
• Look for audit logging being disabled or cleared — audit policy changes, cleared event logs or stopped logging agents are high-priority events in their own right

Daily tier. Each event in task 6 is recorded in the task’s table as explained, benign or escalated.

• Work through every open alert from the SIEM or managed service — close each one with a reason, never in bulk
• Review administrative and privileged changes — new admins, role assignments, group membership changes and new service accounts, matched to approved requests
• Review failed and anomalous sign-ins — repeated failures, password spraying across many accounts, sign-ins from unusual countries or impossible travel
• Review MFA changes — new methods registered, MFA reset or disabled, and bursts of push prompts that suggest MFA fatigue attacks
• Review new mailbox forwarding and inbox rules and firewall or security group changes — external forwarding and rule changes without a ticket are classic early signs
• Record each event reviewed and its outcome — the record is what proves the review happened

Weekly tier.

• Review the week’s alerts closed as false positives — repeated noise from one rule is a tuning job; repeated “explained” events from one user may not be
• Check for activity on disabled, dormant and leaver accounts — any successful sign-in is an escalation
• Review service account and break-glass account use — interactive sign-ins by service accounts and any break-glass use need an explanation
• Review out-of-hours administrative activity and large data exports — against the owner’s explanation or a change ticket
• Reconcile firewall and cloud configuration changes against approved changes for the week — anything without a ticket goes to Phase 5

Runs every tier. The escalation in task 3 is an approval step for the security lead; the review cannot be completed until they approve or reject it.

• Record every exception in the run’s table — event, system, user, time, why it was flagged and who was asked about it
• Chase system owners for explanations with a due date — unanswered questions carry forward to the next run
• Escalate suspected incidents to the incident response process — with the log extract attached and the time the review spotted it
• Raise tickets for control failures — silent sources, logging gaps and misconfigurations found during the review
• Sign off the run — the reviewer confirms every alert and high-risk event category was reviewed for the period

Monthly tier.

• Check retention against policy for each source — for example at least 12 months, with three months immediately available, where PCI DSS applies
• Confirm time synchronisation — systems synced to approved time sources and no drift between sources, so events line up in an investigation
• Tune detection rules — retire or adjust noisy rules, and add rules for gaps found in weekly reviews or recent incidents
• Test that a sample alert reaches the reviewer end to end — generate a known test event and confirm it arrives and alerts
• Check who can read, change or delete logs — access to the log platform restricted, and changes to its own configuration logged
• Review missed or late daily and weekly runs — with reasons, so gaps are explained before an auditor finds them

Quarterly tier. Sign-off is an approval step for the head of security or IT manager.

• Compare log sources against the asset inventory — new servers, SaaS applications and cloud accounts added this quarter should be sending logs
• Confirm each critical system logs the events that matter — sign-ins, admin actions, access to sensitive data, configuration changes and logging changes
• Review the list of high-risk event types against current threats and recent incidents — update the daily review tasks if it has changed
• Review third-party and managed service coverage — what your provider watches, what they do not, and how they hand you exceptions
• Approve the quarter’s review — coverage gaps, overdue exceptions and planned improvements recorded with owners and dates