Every breach you have read about was logged. Nobody looked. A silent log source is the finding, not the absence of alerts during breach response. • Synchronised time is what makes cross-system correlation possible • Retention must exceed realistic dwell time, and logs must be tamper-evident • A log source going silent is an alert, not an absence of alerts CISSP Domain 6: Security Assessment and Testing #CISSP #LogReviews #SecurityTesting #CyberSecurity #InfoSec #StudyTips