logging
termops culturesecurity
Recording what happened so it can be answered for later - by an operator during an incident, or by an investigator afterwards.
The two audiences want different things and the conflict is rarely resolved deliberately. Operations wants recent, verbose, searchable and cheap; investigation wants complete, tamper-evident and kept for a long time. Estates that optimise only for the first discover during an incident that the window closed before the question was asked. The second recurring failure is that logs live on the machine that generated them, which is the machine an attacker controls.
Also known as: logs, audit log