NexusSec.Most firewalls keep only a few days of logs on the device before older entries are overwritten. That is fine for troubleshooting and not enough for investigating an incident found weeks later, or for meeting CERT-In's expectations in India. This is infrastructure guidance, not legal advice.
What the directions ask for
The directions issued by CERT-In on 28 April 2022, under section 70B of the Information Technology Act, include three requirements that land directly on network infrastructure:
- Keep logs for a rolling 180 days within India. Logs of ICT systems must be maintained securely for 180 days, within Indian jurisdiction, and provided to CERT-In when asked.
- Synchronise clocks. System clocks should be synchronised to the NTP servers of the National Informatics Centre or the National Physical Laboratory, or to servers traceable to them.
- Report incidents within six hours. Specified types of cyber incident must be reported to CERT-In within six hours of being noticed.
Read the directions and CERT-In's published FAQs for the full scope, and take legal advice on how they apply to your organisation. Our GRC and compliance work covers the evidence side.
Which firewall logs to keep
- Traffic logs for allowed and denied connections between zones and to the internet, with source, destination, application and user where available.
- Security events: intrusion prevention alerts, malware detections, blocked sites and TLS inspection failures.
- VPN logs: who connected, from where, when, and for how long.
- Administrative logs: logins to the firewall and every configuration change. These are the first thing an investigator asks for.
- System events: reboots, failovers, licence and update status.
Where to keep them
The firewall itself is the wrong place. Local storage is small, and an attacker who controls the firewall controls its logs. Send logs to a separate collector, such as a syslog server, a log management platform or a SIEM, located in India, sized for at least 180 days of your volume, and backed up. Estimate volume from a week of real logs rather than a guess: busy firewalls with full traffic logging produce a lot of data.
Keep them trustworthy
- Point every firewall, switch and server at the same time source, so events line up across systems.
- Restrict who can delete or change logs, and log access to the log store itself.
- Alert when a device stops sending logs. Silence is often the first sign of trouble.
- Test that you can actually find a specific connection from three months ago, quickly, before you need to.
Six hours starts when you notice
A six-hour reporting window is short if nobody is watching. Decide now who reviews alerts, who decides whether an event is reportable, and who sends the report. Logs that nobody reads help afterwards but not in the first six hours. Our managed security service and log monitoring and reporting exist for businesses that do not have someone watching.
