When an incident happens, logs are almost always the only record of what actually occurred, which makes understanding where they live, how they are structured, and how reliably they are preserved a core security skill rather than a purely operational one. Syslog is the standard protocol and set of conventions most Linux services use to record events, and knowing its layout is what turns 'something bad happened' into 'here is exactly the sequence of events, timestamped, that led to it.'
Analogy🏏Cricket
💪 Think of it like fitness: injuries follow a predictable chain — poor warm-up, then form breakdown, then compensation, then the actual tear — and a good physio catalogs where each patient's chain can be interrupted early, rather than only treating the tear afterward. MITRE ATT&CK is the sports-medicine literature of intrusions: a public catalog of every observed breakdown pattern, organized by the stage it serves — how attackers get in, how they escalate, how they extract. Coaches worldwide describe an athlete's risk in that shared vocabulary. This reveals ATT&CK's real value: intrusions become a sequence you can interrupt at stage two, not a disaster you discover at stage five.