Which is the correct order of steps in the logging lifecycle?

• A. Collect logs from sources; store tamper-evidently; transmit to central store; analyze for alerts; retain per policy; delete when retention ends.
• B. Collect logs from sources; transmit to central store; store tamper-evidently; analyze for alerts; retain per policy; delete when retention ends.
• C. Transmit logs to central store first; collect from sources; delete after retention; analyze; store tamper-evidently; retain per policy.
• D. Collect logs from sources; transmit to central store; analyze for alerts; store tamper-evidently; retain per policy; delete when retention ends.

Answer: (B)

The key idea is to secure the log data in a central place before you analyze it, so you can trust the results and meet compliance needs. You start by collecting logs from all sources, then transmitting them to a central store so everything is in one place for correlation and monitoring. Once the logs are in the central repository, you store them in a tamper-evident way (for example, using immutable or append-only storage, checksums, or digital signatures) to prove they haven’t been altered after collection. Only after the integrity of the data is protected do you run analysis to look for alerts. After analysis, you apply retention policies to keep data for the required period, and delete it when the retention ends to minimize risk and storage use.

This order makes sense because analysis relies on trustworthy data; tamper-evident storage provides that trust before any analysis takes place. Transmitting or collecting out of order would risk incomplete visibility or untrustworthy results, and performing analysis before confirming data integrity undermines the purpose of securing the evidence.