Does your organization centralize log data by continuously transferring logs from multiple sources to a consolidated set of log servers?

Centralizing logs on dedicated servers improves security monitoring capabilities by creating a single location for analysis, correlation, and alerting on security events. This approach protects log integrity by separating logs from the systems that generate them, making it harder for attackers to tamper with evidence of their activities. It also simplifies compliance requirements by standardizing log management and retention practices across the organization. Evidence could include documentation of the log collection architecture showing log sources and destination servers, screenshots of log aggregation tool configurations, or a network diagram illustrating the log data flow from source systems to centralized log servers.