CEM is the memo's first priority objective: logs and infrastructure that let you monitor network activity in real time, promptly flag anomalous activity, and respond in a timely manner. These logs are typically ingested and monitored by a SOC.