#enable long term

Ask a forensic investigator what separates a manageable security incident from a multi-month catastrophe, and they will point to the same thing every time: logging failures. Not zero-days. Not bespoke malware. Just the absence of adequate logs, or lo