The first thing a competent attacker does is clear the logs that would reveal them. Streaming logs to isolated, append-only storage the moment they're created preserves the evidence an investigation depends on.
“Local logs are the attacker's first edit.”