Great thread here about logging;
Perhaps the single most important thing you can do to prepare for an incident is to increase Windows event logging. Turn on process auditing, PowerShell logging, and dramatically increase the size of the event logs. Disk space is cheap, use it.
— Jake Williams (@MalwareJake) May 8, 2019