What is an access log?¶
An access log records attempts or events where an account, device, application or connection reached a cloud service, resource or item.
The dangerous assumption is that every access record proves a person deliberately opened or used the data.
What this means in practice¶
Different providers use the term “access log” differently. One service may mean web requests. Another may mean user sign-ins or file views.
Investigators should identify what system created the log and what event causes an entry.
A repeated access pattern may come from automation rather than repeated human action.
Where possible, preserve raw fields and provider event definitions rather than relying only on screenshots or summaries.
What this may show¶
Access may include login, page request, file preview, API call, background synchronisation or automated scanning.
The log may contain the time, IP address, account, session, device or browser information, application, requested resource and outcome.
Access logs may also record failed or denied requests. Those entries can help distinguish attempted access from successful use and may reveal probing, automation or misconfigured applications.
What to do next¶
Check whether the record shows successful access, an attempted request, a token refresh or a background process.
Do not assume that an IP address or device label identifies a person. The account may be shared, the device may be compromised and the connection may pass through a VPN, proxy or corporate gateway.
Compare access records with authentication, session, application and device evidence.
Key takeaway
An access log shows that a system or account reached or attempted to reach a resource, but the human meaning depends on the event definition and surrounding evidence.