Is this a system record, an alert, an intelligence report or somebody’s summary?¶
title: "Is this a system record, an alert, an intelligence report or somebody’s summary?" card_id: "IP-081" status: "complete" source_document: "https://docs.google.com/document/d/1VpQFaMQdAWQ77ePKxtqQohZhFp77nRc7LUqxt1HG6UI/edit?usp=drivesdk"
Is this a system record, an alert, an intelligence report or somebody’s summary?¶
Before relying on an IP address, ask a basic but important question: what exactly am I looking at?
A system record is usually data created automatically as part of a system’s operation. It might record a connection time, a source IP address, a destination, a port or an account identifier. That can be valuable primary material, although you still need to understand how and why the record was created.
An alert is different. It’s normally generated because a rule, threshold or detection model was triggered. The alert might accurately reproduce parts of the underlying data, but it’s still the output of a process. You need to know what triggered it, whether the rule changed, and whether the original records remain available. An alert that says “suspicious login” proves that the system classified something as suspicious. It doesn’t, by itself, prove who logged in or that an offence occurred.
An intelligence report is different again. It may combine records, research, assessments and information from other sources. It can guide an investigation, but its conclusions shouldn’t automatically be treated as the original evidence.
And then there’s the human summary: an email, spreadsheet entry, case note or statement saying that an IP address was “linked” to an event. A summary may be accurate, but fields can be omitted, times rounded, time zones lost and cautious conclusions shortened into stronger ones.
So preserve the earliest available record. Find out which system produced it, what fields existed, how the relevant IP address was extracted and what happened to the data before it reached you. Keep the alert or report as well, because it explains why attention was drawn to the event, but don’t confuse it with the underlying record.
The label matters because each source supports a different conclusion. You may be able to say that a system recorded an address, that a rule generated an alert, or that an analyst made an assessment. Those aren’t interchangeable, and none of them, without more, identifies the person responsible.