Detection Tools - Logs

• In real time detection, the detection tool may not be sufficient to keep up with network traffic or it may be positioned on the network in a way that it is unable to capture all relevant data

• Logs may not identify the perpetrator in any useful way

• Logs may have been compromised