These days there is a lot of discussion on how to secure servers and communications. What I see missing from the advice is how to log unauthorized (and authorized) activity in real time to another uncompromised machine?

What services and open source projects exist to determine when a machine has been compromised and to collect evidence of the compromise in a real time way to be able to figure out what the attacker has done in a way that makes it much harder for them to cover their tracks?

For example, what can/could Sharyl Attkisson and the administrators at CBS and other journalism outfits do to discover they've been hacked and collect information on the hacking that would be a smoking gun to point to who was responsible and what they did while snooping around?