Ideally, the systems that prevent "infiltration" are separate from the systems that detect (and even prevent) "exfiltration". Just because you breached the firewall, that doesn't mean you can delete all the logs of network traffic passing through it.

It's of course much more difficult than that in practice, but that's the general idea.