syslog

Syslog is the long-standing standard for sending log messages from servers, network gear, and applications to a central collector. SOC teams rely on syslog forwarding to feed events from across the environment into their SIEM. It matters because centralized logging is the raw material of detection; without it, evidence stays scattered on individual devices where attackers can erase it.