NCSC

https://www.ncsc.gov.uk/blog-post/what-exactly-should-we-be-logging

The logging made easy project is helpful if you are starting with absolutely no centralised logging.

https://www.ncsc.gov.uk/blog-post/logging-made-easy

NSA

https://apps.nsa.gov/iaarchive/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm

CISA

https://us-cert.cisa.gov/ncas/alerts/aa20-245a

ASD

https://www.cyber.gov.au/acsc/view-all-content/advice/guidelines-system-monitoring