Which type of log collection is focused on detecting and responding to attacks, malware infection, and data theft?

Intrusion detection is a security control mechanism (IDS/IPS), not a category of log collection; it is a tool that may consume security logs rather than a log collection type itself.

Operational log collection focuses on system health, performance, uptime, and availability-not on detecting or responding to security threats like malware or data theft.

Security log collection is purpose-built to capture events related to cyber threats, including intrusion attempts, malware activity, and unauthorized data access. It provides the visibility needed for security operations teams to detect, investigate, and respond to incidents. This type of logging feeds into SIEM systems and SOC workflows focused on threat detection and response.

Compliance log collection is oriented toward meeting regulatory requirements and audit trails (e.g., PCI-DSS, HIPAA), not specifically on detecting attacks or malicious activity in real time.