What it means
Logs describe observations made by software or devices: an account signed in, a file changed, a request failed, or a connection started. A useful record identifies when and where the observation happened, the actor or object involved, the action, and its result. The record’s meaning depends on the system producing it. A successful authentication record establishes that a credential was accepted; it does not establish who physically used it. Collection delays and missing fields can change how a timeline should be interpreted.
AN ILLUSTRATIVE SCENARIO
Finding who changed a shipping address
A small retailer notices an order redirected after checkout. Web access logs show requests, while application audit logs identify the order and the account that changed its delivery address. The analyst compares both with sign-in records. A shared office IP address alone cannot identify a person. If the application never recorded the change, collecting more firewall logs will not reconstruct that missing business action.
Put it to work
- Choose security questions first, then identify the records needed to answer them. Include application actions as well as operating-system and network events.
- Synchronize clocks and record time zones. Preserve original records alongside parsed fields, and restrict access because logs can contain personal or sensitive information.
- Define retention, collection-health checks, and ownership. Avoid recording passwords, session secrets, or complete sensitive request bodies simply because storage is available.
How to check your work
Perform an approved test action and find its complete record in the destination system. Compare the event time, arrival time, actor, object, outcome, and retained raw data with what actually happened.
Connect the ideas
- Alert
A notification that a rule or model wants a human to look at one or more records.
- Evidence
A record you are willing to cite in a decision, with enough provenance to explain what it can prove.
- Provenance
The recorded origin, collection method, transformations, and completeness limits of a piece of evidence.
- Audit trail
An append-oriented history of security-relevant actions that can be shown to a later reviewer.