Question 1

What is Log Management?

Accepted Answer

Log Management is a system that collects, stores, and analyzes computer traffic data (log files) from devices such as firewalls, Microsoft Entra ID, Microsoft 365, and endpoint security (EDR) systems in one place — enabling audit and retrospective search in compliance with Thailand's Computer Crime Act B.E. 2560 (2017).

Question 2

Which organizations are required to keep logs under Thailand's Computer Crime Act?

Accepted Answer

Organizations that count as "service providers" under the Act, such as ISPs and hosting providers, must retain logs. Whether a company, agency or university that gives internet access only to its own staff or students is covered is not settled by the Ministry of Digital Economy and Society's 2021 notification, so take legal advice. A restaurant or other business that offers Wi-Fi only as a side service may choose one method of identifying its customers, such as CCTV with a usage record or a daily record of customers' usage documents. Non-compliance can result in fines of up to ฿500,000.

Question 3

How long do logs need to be retained?

Accepted Answer

Under Section 26 of the Computer-Related Crime Act B.E. 2550 (2007), as amended by the Act (No. 2) B.E. 2560 (2017), service providers must retain logs for at least 90 days, extendable up to 2 years in special cases if ordered by an authorized official.

Question 4

How is zcrLog different from a SIEM?

Accepted Answer

zcrLog handles compliance log retention, while a SIEM runs SOC operations. zcrLog collects logs from firewalls, Windows, EDR, Microsoft Entra ID, Microsoft 365, AWS CloudTrail and Google Cloud, and retains them as Thailand's Computer Crime Act requires. For procurement it references NECTEC standard มศอ. 4003.1-2560: the approved partner matches the actual product certificate to the proposed version and deployment, and the organisation keeps its legal responsibility. SOC work such as incident SLA tracking and threat hunting runs on zcrSIEM, a separate product that ingests its own sources directly — zcrLog is not required.

See risk clearly. Defend without borders.

See risk clearly.
Defend without borders.