What is an event?¶
An event is something a system recognises as having occurred and may record, process or report.
Avoid this assumption: That every event represents a deliberate action by a person. Many events are created automatically by operating systems, applications, services, security tools, scheduled tasks and background processes. An event might be a successful login, a failed authentication attempt, a file being opened, a firewall connection, a password reset, an application error, a process starting, a cloud permission change or an alert condition being met.
The system decides what counts as an event. That definition may be narrow or broad. One user action may create several events across different systems. Equally, several user actions may be summarised into one event. A system may record the start of an activity, its completion, its failure or only the final status.
An event can exist even where no human directly caused it. A synchronisation service may connect to a cloud account. An API may create or modify data. Security software may quarantine a file. A scheduled task may run under a named account. These records may look like user activity unless their context is understood.
A recorded event may support that the system detected or processed something at a particular time. It may contain identifiers linking an account, device, session, process, request or network connection. It does not automatically establish that the underlying activity occurred exactly as displayed, that the named account holder was responsible or that the event was malicious.
Investigators should identify the event source, event code, field definitions and the condition that causes the event to be generated. Preserve related records and check for preceding, following and duplicate events.
Where event generation is unclear or disputed, obtain technical explanation from the system owner or a specialist rather than relying on the label alone.
Operational takeaway¶
Interpret an event by understanding what caused the system to generate it, not merely by reading the event label.