What is the difference between an alert and the underlying evidence?¶
An alert is the system’s notification or interpretation. The underlying evidence is the source data from which that alert was generated.
Avoid this assumption: That the alert contains everything needed to understand and prove the activity. It may only contain selected fields, a summary, a score or a conclusion produced by a rule. For example, an alert may state that an account showed “impossible travel”. The underlying evidence may include two authentication events, their timestamps, source IP addresses, device details, session information and geolocation enrichment. The alert is the conclusion that those records met a detection condition. The source events are the records that must be examined.
The alert may omit context. One event may have been generated by a VPN, mobile network, cloud service, automated process or stale session. The locations may be estimated from IP addresses rather than directly observed. The timestamps may reflect ingestion time rather than the exact time of user activity.
Underlying evidence may also include configuration information, rule logic, event codes, raw fields and surrounding activity. Without it, investigators may be unable to test alternative explanations, identify parsing errors or establish whether several alerts arose from the same event.
Preserve the alert because it records what the system detected and when. Then request the original source events, the relevant time window, field definitions, detection rule, rule version, enrichment sources and analyst notes.
An alert may still have evidential value. It can show that an organisation’s security system raised a concern, triggered a response or influenced later decisions. But that is different from proving the underlying conduct.
Where only a screenshot or summary is available, record that limitation clearly and avoid presenting the alert label as an established fact.
Operational takeaway¶
Preserve the alert, but base your interpretation and attribution on the underlying source records and the rule that produced it.