NIST SP 800-92 2: Log Generation: OS, Application, Security Tools, Network, Cloud, Required Event Content

Configure log generation across all sources per NIST SP 800-92 Chapter 2 (Log Categories) + Chapter 3 (Log Management Infrastructure) + Chapter 5 (Log Management Operational Processes). Operating system log generation per Section 2.2.1: enable and configure system logs (Windows Event Log + Linux syslog/journald + macOS unified log + Solaris audit) capturing authentication + privilege use + system events + service starts/stops + audit events. Application and service logging per Section 2.2.2: enable application audit logs covering authentication + authorisation + transactions + errors + administrative actions with consistent format and identifiers across the application portfolio. Security tool logging per Section 2.2.3: include firewall + IDS/IPS + antivirus + EDR + vulnerability scanners + DLP + WAF + identity broker + secrets management + cloud security posture + container runtime + similar. Network device logging per Section 2.2.4: router + switch + WAP + load balancer logs covering authentication + configuration change + interface state + ACL match + packet drop where appropriate. Cloud and SaaS log generation: enable provider audit logs (AWS CloudTrail + Azure Activity + GCP Cloud Audit Logs + M365 Unified Audit + Google Workspace + Salesforce + similar) covering identity + administrative + data access events. Required event content per Section 2.3: timestamp (with timezone) + event source + event type + user/principal + asset + action + outcome + relevant context fields + correlation identifier where applicable.