You can’t collect logs after an incident. Whatever wasn’t stored beforehand is gone.
When you call in an incident response firm, the first thing they ask for is logs, to work out what was affected and build a timeline. If ransomware encrypted a PC, the logs on it are lost or can no longer be trusted.
One preparation step is to copy selected Windows event logs off each PC to cloud storage. ir-logs-piper does this using Fluent Bit and Cloudflare R2.
Why it suits a small business:
- No log server to build, patch or lose.
- One install script per PC.
- The scripts and Fluent Bit are open source and free to use.
- Cloudflare R2 has a generous free tier of 10 GB storage. You pay only if you exceed the free limits.
- Downloads are free too, so your incident response firm can pull logs directly using a read-only token that expires.
Start with these in the repo:
audit-policy.md: required setup, otherwise key events are never generated.capacity-planning.md: whether your fleet stays within the free tier.security-model.md: the risks and how to reduce them.
Then give it a free test drive on a few PCs.