In every intrusion this desk has reviewed, the telemetry existed and nobody was reading it.
That is not a criticism of the people involved. Logs are generated by default, in volume, in formats nobody chose, and reading them is somebody's fourth priority until the week it becomes the only one. But it changes what the job actually is. You are rarely missing data. You are missing attention.
Start from what you already have, because it is more than you think. Authentication logs on the domain controller or the identity provider. Firewall and VPN session records. Web server access logs. Mail gateway logs. DNS query logs, which almost nobody keeps and which answer more questions than the rest combined. Endpoint logs, if anything is deployed. DHCP leases, which are the only thing that will later tell you which physical machine an address was.
Now the thing that should change how you think. In ransomware cases reported publicly, the attacker is typically inside the environment for weeks before anything is encrypted — not minutes. Weeks. Everything they did in that time — enumerating shares, testing credentials, staging archives, failing to log in as accounts that do not exist — is loud, if anyone is listening.
Long dwell time is good news, correctly understood. It means the intrusion was survivable. It means there was a month of evidence produced before the damage, and the outcome was decided not by the vulnerability that let them in but by the fact that nobody looked.
So keep three things, at minimum, and keep them somewhere the attacker cannot edit. Authentication events, because they show the moment normal becomes abnormal. DNS queries, because malware has to resolve something. And outbound network flows, because exfiltration is the one thing an attacker cannot avoid doing.
Ninety days is a reasonable floor for retention. Most intrusions are discovered long after they began, and a log that has already rotated is the same as a log you never collected.
One habit worth building now: once a week, pick one account and read everything it did. Not looking for anything in particular. You are learning what normal looks like, which is the only way you will ever notice abnormal.