Is this a system record, an alert, an intelligence report or somebody’s summary?¶

The label matters because each source supports a different conclusion.

Source	What it may establish	What it is not by itself
System record	What a system recorded, with its fields and timestamp	Proof that the system was configured or interpreted correctly
Alert	That a rule, threshold or model triggered	Proof that the event was criminal or that a person caused it
Intelligence report	An assessment combining information	The underlying original records
Human summary	What somebody says the records showed	A substitute for the complete source context

Preserve the chain back to source¶

Keep the alert or report because it explains why attention was drawn to the event. Then identify the producing system, original fields, time zone, extraction method and any transformations or rounding. Seek the earliest available record and retain the summary alongside it.

Safe conclusions¶

You may be able to say that a system recorded an address, a rule classified activity as suspicious, or an analyst assessed the information. Those statements are not interchangeable, and none alone identifies the person responsible.