Overview

Home About this project and why it exists

Reference

Windows Event Log Reference 99 events across 5 log sources NIST SP 800-53 Mapping 34 controls to event-code evidence MITRE ATT&CK Coverage 30 techniques, tactic gap analysis MITRE ATLAS Coverage AI/ML threat map, 6 techniques + honest gaps CIS Controls Coverage Controls 5 & 8, 6 safeguards + honest gaps PCI DSS Requirement 10 Log & monitor access, 7 sub-reqs + honest gaps DISA STIG Coverage Windows Server 2022 V2R4, 4 rules + honest gaps

Tools

Gravity Scanner Live policy, gap analyzer, dependency map 7 views

Blog

Blog Notes on logging, cost, and detection tradeoffs

Blog

Notes on log management, cost, and detection

Short, practical write-ups on the tradeoffs behind everything else on this site.

Balancing Log Management With Licensing and Resource Costs

Every log source you enable is a recurring decision, not a one-time switch. A practical framework for deciding what to keep, filter, sample, or drop — and why the "log everything" instinct fails economically and operationally.

More posts as they're written.