Collect Audit Logs There's a predictable early move in a lot of intrusions: once an attacker is on a machine, they clear its local logs. If the only record of what happened lives on the same computer that was compromised, you've effectively handed the person you're investigating the ability to edit the evidence. Control 8.2 solves that by getting your logs off the individual machines and into a place an attacker can't quietly reach. If 8.1 was the decision about what to record, 8.2 is the act...