Plain-English explainers on SIEM, log management, EU compliance and the agentic SOC: what the terms mean and what they require in practice.
What to log, how long to keep it, the monitoring duty, and the 24h/72h/1-month incident reporting deadlines under the NIS2 Directive.
The Netherlands implements NIS2 through the Cyberbeveiligingswet, in force from 15 August 2026 with no transition period. If you operate in the Netherlands but do not read Dutch, this guide explains who is covered, what the law requires, and what it means for your logging and monitoring.
Detection under Article 10, what to log, retention, and the 4h/72h/1-month major-incident reporting clock for financial entities.
How long to keep logs under PCI DSS, HIPAA, SOX, GDPR, ISO 27001, NIS2 and DORA: side by side, plus how to set a policy.
Annex A controls A.8.15 (Logging), A.8.16 (Monitoring) and A.8.17 (Clock sync): what to log, retention, and what auditors expect.
Why logs contain personal data, the GDPR principles that apply, the right to erasure, and how to redact PII responsibly.
What Security Information and Event Management is, what it does, how it works, and how the modern AI-era SIEM has evolved.
How attributing risk to entities, instead of one alert per rule, cuts alert fatigue and surfaces the attacks that matter.
How behavioral baselines for users and entities catch compromised accounts, insider threats and lateral movement that static rules miss.
Security Orchestration, Automation and Response: the three pillars, playbooks, SOAR vs SIEM, and where the human stays in control.
Managing detections like software (Git, peer review, CI/CD testing and Sigma) for higher-quality, auditable, reversible detection content.
The knowledge base of adversary tactics and techniques, the Enterprise matrix, and how teams use it for detection and coverage.
AI agents that plan and run investigations: how it differs from SOAR, and why human-in-the-loop governance is the part that matters.
What MCP is, the real risks (prompt injection, tool poisoning, over-broad scopes), and how to connect AI agents to your logs safely.
Why AI-assisted development needs production feedback, and how MCP lets the agent that wrote the code verify deploys and debug errors from the IDE.
Software that triages alerts, investigates and writes verdicts at machine speed, what it does well, and where humans stay essential.
How an AI agent queries logs, correlates deploys and changes, and proposes a likely cause with evidence. Verify in minutes, not hours.
How collecting, parsing, storing, searching and retaining logs works, and how it relates to observability and SIEM.
What each does, how they differ on data scope, retention and response, and which one you actually need.
Columnar vs inverted index: compression, query speed and cost for log analytics, and where Elasticsearch still wins.
Both share a pipe-based model, so Splunk queries translate easily. The difference is the engine, command breadth and AI generation.
What it is, why JSON beats free-form text, and the practices (schema, levels, context, correlation IDs, PII) that make it pay off.
What log shippers do, how Vector, Fluent Bit, Fluentd, Filebeat and the OpenTelemetry Collector compare, and how to choose one.