Glossary: Logs and Data Sources for Investigations

Central log collection

Also written: central log copy, log server

Sending logs to a SIEM or log server as they are written. An attacker who controls one server can edit its local log, but not the copy already sent away.

Where the book teaches it

Chapter 4: Security Tools, Dashboards, Packet Captures and Integrity

Related terms

Integrity SIEM (security information and event management)WORM (write once, read many)