When the breach was discovered and the logs were reviewed, it was discovered that the attacker had purged the logs on the

system that they compromised. How can this be prevented in the future?