What questions should I ask the person who supplied the logs?¶

The person who supplied the logs may hold essential information about what the records are, how they were produced and what may be missing.

Avoid this assumption: That an export is self-explanatory because the columns and events look technical or authoritative. Start by asking which system created the original records and which system produced the export. These may not be the same. Establish whether the data came directly from a source device, server or application, or through a SIEM, dashboard, reporting tool or analyst-created spreadsheet.

Ask what date and time range was searched, which time zone is displayed and whether the source system clock was synchronised. Confirm whether the timestamps represent the original event, receipt, processing, ingestion or display time.

Ask exactly what filters, search terms, rules or exclusions were applied. Determine whether entries were sampled, deduplicated, normalised, enriched, translated or manually selected. Ask whether any fields were hidden, removed, renamed or converted during export.

Establish what each important field means in that system. A username may be an account owner, executing identity or display name. A device field may identify the source, destination or reporting host. A success status may refer only to one processing stage.

Ask about retention and completeness. Are older or surrounding records still available? Could log rotation, licensing, storage limits, outages or configuration changes have created gaps? Were there known clock, collection or ingestion problems?

Finally, ask who can explain the system configuration and provide source records, field documentation, account information and related logs. Record the supplier's answers and preserve any query screenshots, report settings or instructions used to generate the export.

Where the logs are central or contested, seek direct evidence from the source system and specialist interpretation rather than relying only on a prepared report.

Operational takeaway¶

Establish the source, time basis, filters, transformations, field meanings, retention and completeness before treating supplied logs as reliable evidence.