FREE TEMPLATE · EXCEL WORKBOOK
Log source and detection use-case register
A working register to plan and evidence security logging and monitoring. It lists 32 typical log sources and 30 pre-filled detection use cases mapped to each other, plus a detection test log and a retention decision sheet, so you can show supervisors and auditors what you collect, what you detect and how you know it works.
What's inside
- Log source register with 32 sources across identity, endpoints, cloud, network, applications and security tools, tiered by priority
- Detection use-case register with 30 use cases mapped to log sources, threat type and MITRE ATT&CK tactic
- Detection test log to record simulations, alert results and response times
- Retention and integrity decision sheet with rationale per log category
- Status choices and owner fields to track coverage gaps
Worksheets
Log sourcesDetection use casesDetection test logRetention decisions
How to use it
- Mark which log sources exist in your environment and who owns them; delete rows that do not apply.
- Review the use cases, keep those that match your risk assessment and add your own.
- Record for each use case whether it is implemented, who handles alerts and which response playbook applies.
- Test priority use cases at least yearly and record the results in the test log.
- Review the register after significant incidents and major changes, and attach it as evidence to your monitoring controls.
Same house style as every Secrato template: a start sheet with instructions, light blue cells to fill in, and version control. Free to use within your organisation. This template is practical guidance, not legal advice.
Get the template
Enter your work e-mail and we will send you a personal download link straight away. We may follow up with related guidance; you can opt out at any time.
