Accounting
Recording what authenticated users do so actions can be reviewed and attributed.
Centralized logging is the practical implementation of accounting — forwarding events to a SIEM so they can be correlated, retained, and protected from tampering. Effective accounting depends on synchronized time (NTP) across sources so events can be sequenced, and on write-once or access-controlled storage so the logs themselves can’t be altered to cover an attacker’s tracks.
PlayPrepHQ study notes are written and reviewed against primary exam sources. How we create & review content →