For security professionals and forensics investigators, it doesn’t get any more basic than the unrelenting flow of log data generated by countless machines attached to the enterprise backbone. The activity, health, status, and anomalies of these endpoints and systems are time-stamped and delivered to some repository, usually a syslog, a security information and event management (SIEM) tool, or some managed security service provider’s MSSP) archive in the cloud.

Read full article on Dark Reading