Logging of internal network breach activity.

Hey.  When reading several articles about companies that were hacked, assessing the depth of the breach, they seem to be able to trace where the attack came from and where it went in the network.  What exactly are they looking at, or what exactly did they have in place that enabled them to know where the breach came from and what stations/devices were used to pivot and gain further access?  If there is a information that you could point where I can readup on what a strategy looks like, please feel free to post.  Thanks.