How do I assess whether cloud records are complete?¶

Define what the record set claims to cover, then test its systems, period, permissions, settings and export method. A detailed-looking file can still represent one product, one event category or the first page of a much larger result.

Establish the collection envelope¶

Record the service, tenant, accounts, date range, time zone, event categories, source interface or API, filters and collector permissions. Check whether authentication, session, application, administrator, security and resource activity are stored separately.

Subscription level, historical logging settings and retention determine what could be present. User-facing activity may omit technical or privileged events, while a security platform may retain alerts after the underlying logs have expired.

Test internal and external consistency¶

Look for abrupt start or end points, missing periods, changes in event volume, result limits, pagination tokens and unexplained gaps in sequences. Compare expected recurring events before, during and after the period. Do not assume that event IDs are sequential unless the provider says they are.

Cross-check the export against administrator configuration, collection records, provider schemas and - where relevant - device data, help-desk tickets, security alerts or other organisational logs. A second export made with documented settings may help expose filter or permission differences.

Completeness is normally a scoped conclusion: complete for specified sources and criteria, not complete in an absolute sense. Record what was examined, what was unavailable and how each gap affects the question.