Consistent logging practices save analysts from guessing which field holds the data they need. This style guide captures the conventions I share with teams when documenting detections and playbooks. Use it as a baseline and tailor to your stack.
Naming conventions
Use lowercase snake_case for log fields and detection metadata. Prefix enrichment fields with the source (geoip_country, edr_process_name). Reserve the threat.* namespace for fields that indicate confirmed malicious activity.
Timestamps
Store all timestamps in UTC using ISO 8601 format. Include both the original event time (event.original_time) and the processing time (event.ingested_time) so you can measure pipeline delays.
Severity levels
Adopt a five-level scale: informational, low, medium, high, critical. Define criteria for each level in your runbook and reference those definitions in dashboards so stakeholders interpret charts consistently.
Example alert entry
{
detection_id: azure-signin-anomaly,
severity: high,
signal_type: authentication,
entity: {
user_principal_name: analyst@example.com,
ip_address: 203.0.113.24
},
investigation_steps: [
Confirm user location,
Review last 5 sign-ins,
Check MFA reset history
]
}Documentation checklist
- Describe what success and failure look like for each detection.
- List telemetry sources and retention periods.
- Link to automation runbooks or SOAR playbooks.
- Include sample queries analysts can copy into their tooling. Aligning on a style guide keeps logs readable and accelerates every subsequent investigation.