Ransomware Readiness Starts with Your Logs: What Investigators Ask for First

Most ransomware plans focus on backups, isolation and restore times. Those matter. Yet when responders arrive, their first requests are about evidence. They want your logs, and they want them quickly.

The rules are changing in the UK as well. In July 2025 the Government confirmed plans to ban ransomware payments by public sector bodies and operators of critical national infrastructure, alongside a payment prevention regime for other organisations and a mandatory incident reporting regime. The detail, including reporting timeframes, is still being developed. For organisations in scope, paying to make the problem go away is coming off the table. Recovery will depend on what you know about the attack, and that knowledge comes from your data.

The Questions Investigators Ask First

Whether you use an internal team or an external incident response provider, the first questions tend to be the same:

• How did the attacker get in, and when?
• Which accounts did they use or create?
• Which systems did they reach before encryption started?
• Did they take data out of the network before the ransom note appeared?
• Are they still inside?

Each answer depends on a specific set of logs. If those logs don’t exist, weren’t retained or sat on systems the ransomware encrypted, the investigation slows and your options narrow.

The Logs That Matter Most

Start with these sources and confirm each one is collected, retained and searchable:

• Identity and authentication logs, covering sign-ins, failed attempts, MFA prompts, privilege changes and new accounts. Ransomware groups rely heavily on stolen credentials, so this data often holds the first clue.
• Endpoint telemetry from your EDR platform, showing process execution, use of admin tools and attempts to disable security controls.
• Remote access logs from VPNs, remote desktop gateways and third party access tools.
• Network flow and DNS data, which help you spot command and control traffic and large outbound transfers.
• Cloud control plane logs, such as AWS CloudTrail, showing changes to permissions, storage and backup settings.
• Backup system logs, because attackers often try to delete or corrupt backups before they encrypt anything.

Protect the Evidence

Ransomware operators know your logs work against them. Clearing event logs and disabling logging agents are common steps before encryption. If your only copy of the evidence sits on the systems under attack, you risk losing it at the moment you need it.

Store security logs away from your production environment, in a separate account with its own access controls. Make critical logs immutable where possible. In AWS, a dedicated log archive account holding your Amazon Security Lake data, with tightly controlled access and S3 Object Lock applied, keeps evidence out of reach of an attacker who compromises your main environment.

Retention Long Enough to Find Patient Zero

Encryption is usually the last stage of an intrusion. Attackers commonly gain access, explore the network and steal data over days or weeks before they deploy ransomware. Your retention needs to cover the whole period.

Check your current retention against a realistic dwell time. Use lower cost storage tiers to keep older data searchable without inflating your SIEM bill. The first login from a compromised account is often the single most important event in the investigation, and it’s usually the oldest.

Rehearse With Real Data

Tabletop exercises often stop at decisions: who calls whom and who approves what. Add a data step. Pick a scenario, such as a compromised remote access account, and ask your analysts to trace it through your actual logs. Time how long each question takes to answer. The gaps you find show you where to invest first.

A Short Readiness Checklist

• Confirm each of the 6 log sources above is collected, retained and searchable.
• Check your logs are stored where a compromised domain administrator account has no access to them.
• Record how far back your searches reach today, source by source.
• Make sure your incident response provider knows how to access your security data, and test that access before you need it.
• Review your obligations under current and proposed UK rules, and confirm you’re able to pull the facts for an initial report quickly.

When encryption hits, your backups decide how fast you recover. Your logs decide whether you understand what happened and whether you stop it happening again.

Get In Touch

If you would like to talk through any of the points in this article, our team is happy to help. Visit hoopcyber.com/contact or email .