How do I assess whether cloud records are complete?¶

Cloud records should not be assumed complete merely because they look detailed.

Evidential caution: that a provider export shows everything the service recorded.

What this means¶

Completeness depends on the product, subscription, logging settings, retention, permissions, filters and systems included in the export.

A user-facing activity page may exclude technical or administrator events. A security platform may retain alerts but not the underlying provider logs.

Also consider retention. Older records may have expired before collection, even if recent activity appears complete.

Where completeness matters, seek provider definitions, administrator confirmation or specialist review.

Where the export stops abruptly, check whether result limits or pagination explain the ending. A technically valid export may still contain only the first page of relevant events.

What to check or do next¶

• Start by identifying what the record set claims to cover.
• Check the service, tenant, account, date range, event categories, time zone and export method.
• Ask whether authentication, session, audit, application, administrator and file records are held separately.
• Look for gaps in event numbering, missing periods, unexplained changes in logging volume and evidence that logging was enabled only after the event.
• Check whether the person producing the export had sufficient permissions to see all relevant records.
• Compare cloud records with device evidence, help-desk tickets, security alerts, communications and organisational logs.
• Do not fill gaps with assumptions. Record what is present, what is missing and why the absence may have occurred.