What event did the system actually record?¶
title: "What event did the system actually record?" card_id: "IP-018" status: "complete" source_document: "https://docs.google.com/document/d/1C5bXM03y2iCr9R6XluzEac4eqkRkkG6AxGl1dFrrvBI/edit?usp=drivesdk"
What event did the system actually record?¶
An IP address in a record tells you very little until you know which event it relates to.
Start with the action recorded by the system.
Was it:
A successful login?
A failed login attempt?
A password reset?
A message being sent?
A file being uploaded or downloaded?
An account being created?
A connection to a server?
Or a security alert generated by the system?
Those events don’t mean the same thing.
A failed login attempt doesn’t show that somebody accessed the account.
It shows that the system received an attempt which it didn’t accept.
A successful login shows that the system accepted the authentication or session presented to it.
It doesn’t, by itself, identify the person responsible.
And it doesn’t prove that every later action involving the account was carried out by the same person.
A file upload record may show that data was uploaded through a particular account or session.
A connection record may only show that traffic reached a system.
That connection could have been created deliberately by a person.
But it could also have been generated automatically by an application, a background service, a security tool or malicious software.
A security alert needs similar care.
An alert usually means that the system detected something matching a rule or pattern.
It doesn’t necessarily mean that the suspected activity definitely occurred in the way described by the alert.
You need to understand what triggered it.
The outcome of the event matters as much as its name.
Look for descriptions such as:
Successful.
Failed.
Allowed.
Blocked.
Completed.
Rejected.
Started.
Cancelled.
A record labelled “login” may describe an attempt rather than a successful entry into the account.
A firewall record labelled “connection” may show that traffic was blocked before any communication was established.
A message event might show that a message was created, queued, sent, delivered or opened.
Those are different stages.
You also need to establish how the IP address is connected to the event.
Is the address recorded directly on the same event?
Was it recorded when a session began and then associated with later activity?
Or does it simply appear nearby in the record without a clear link?
Don’t assume that an IP address belongs to an event just because both appear on the same page or in the same export.
Your description should match the event actually recorded.
For example:
“The platform recorded an unsuccessful login attempt against the account from this IP address.”
Or:
“The service recorded a file upload through a session associated with this IP address.”
Or:
“The firewall recorded and blocked a connection attempt from this IP address.”
That is more accurate than saying:
“The offender used this IP address.”
Before moving on, establish:
What action the system recorded.
Whether it succeeded or failed.
And how the IP address is linked to that event.
Then you can ask the next question:
Does the record actually support the allegation being made?