But I think the main points for minimum effective security logging would be process event trees, network events tied to processes, state of installed apps and configs, and hashes where ever you can get them.