The best answer is A. Using automated tools to collect logs and raise alerts based on use cases.
ISACA’s log management guidance emphasizes building log management programs that use automated collection, correlation, and alerting driven by defined use cases. It specifically discusses configuring use cases and alerts so that relevant events generate actionable alerts. This creates value by improving detection, response speed, and operational visibility at scale.
Option B. Reporting results to senior management can be useful, but that is more about governance reporting than day-to-day monitoring and management.
Option C. Selecting logs only from critical systems may reduce volume, but by itself it does not provide the active monitoring and alerting needed to create operational value.
Option D. Encrypting logs before archiving protects confidentiality and integrity, but it does not best help monitor and manage logs in an operational sense.
Therefore, A is the correct answer because automated log collection and alerting based on defined use cases is the most effective way to turn operational logs into actionable organizational value.
References (Official ISACA):
ISACA Journal, Log Management as an Enabler for Data Protection and Automated Threat Detection.
ISACA Journal, A Framework for SIEM Implementation.
ISACA, Securing Artificial Intelligence: Opportunities and Challenges.
Submit