You are standing up monitoring from scratch. Which log sources do you onboard first and why?

Start with identity and endpoint, because most intrusions run through credentials and process execution. Onboard directory and cloud sign in logs first, then endpoint telemetry with process creation and command lines, then DNS and proxy or firewall egress, then email security, then cloud control plane audit logs. Sequence by detection value per unit of ingest cost, and confirm parsing and clock synchronization before moving on.

I sequence by how much of the attack chain each source shows me per dollar of ingest. Identity is first: directory authentication plus cloud sign in logs, because credential abuse touches almost every intrusion and those logs are comparatively small. Endpoint is second, specifically process creation with full command lines, parent process and network connections, since that is where execution and lateral movement become visible. Third is egress, DNS plus proxy or firewall, which gives me command and control and exfiltration. Fourth is email, because that is the most common entry point. Fifth is the cloud control plane audit trail, which is where cloud persistence lives. For each one I do not call it done until the parser maps fields correctly, timestamps are in UTC and agree across sources, and at least a handful of detections are live on it. An onboarded source with no detections is just a storage bill, and I have inherited a few of those.