What is the difference between an alert and an audit record?¶
An alert is a warning generated because a system detected a condition or pattern of concern.
An audit record is a record that an event or action occurred.
What this means in practice¶
A provider may alert on an unusual login, impossible travel, large download or permission change. The alert reflects a detection rule or risk model.
Alerts can be false positives. Audit records can also be incomplete or technically ambiguous.
Investigators should preserve both where available.
Use the alert to understand what triggered concern, when it was generated and which risk indicators were applied.
Use the audit record to identify the actual account, session, application, resource, time, IP address and outcome.
The alert time may differ from the event time because the provider may detect or reclassify the activity later.
The strongest interpretation comes from combining the alert, underlying audit record, session evidence, device evidence and wider context.
A single alert may also group several underlying events. Always identify whether the warning relates to one access, a sequence of activity or a change in the provider’s assessment over time.
What this may show¶
The audit record may show the underlying sign-in, file access, role assignment or application action.
What this does not show on its own¶
The dangerous assumption is that an alert proves the underlying activity was malicious.
Do not report that the provider “confirmed compromise” unless that is genuinely what the evidence says. Usually the provider flagged risk and recorded events.
Key takeaway
An alert expresses provider concern; an audit record describes an event. Use both, but do not treat risk detection as proof of malicious activity.