Securing and storing Active Directory logs

Question

If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their integrity?

Answer 1

A centralized logging server like a SIEM which has regular backups would be a great place to start. This would also allow you to more easily analyze these logs for anomalies versus reading the raw event logs. There are a variety of open source solutions that cost no money that can perform this task.