I also know very little, but something that struck me upon reading your question: if a breach is successful, the logs can't be relied upon for detection/analysi

I also know very little, but something that struck me upon reading your question: if a breach is successful, the logs can't be relied upon for detection/analysis if they're on the same server. It's important to ship them elsewhere.