Every system, application, and device within your environment is constantly producing information. Login attempts, access to files, configuration changes, network communications - everything produces a footprint of some kind. Your only reliable proof that something went wrong is the presence of its "footprint."