A firewall can block known threats, but logs provide the record of what happened if a threat manages to bypass your initial defenses. Logs act as the digital forensic evidence needed to investigate how a security gap was exploited and which files were targeted.