In simple terms, a log is a record of an event that has occurred within the systems and networks of an organization.
When we speak about security, the logs can be generated by various sources such as antivirus, firewalls, intrusion prevention systems, and operating system.
Nowadays, organizations have hundreds of servers and logging into each of them and checking security-related events is not a feasible solution.
This is one of the reasons why bringing all logs to a single place where it can be stored and analyzed is very important. Centralized logging and archiving is also a regulatory requirement. This is the reason why organizations are moving toward a concrete log monitoring solution.
This is further illustrated in the following diagram:
In the preceding diagram, we see that logs from various devices such as firewalls, switches, and routers...
