What is an authentication log?¶

An authentication log records events connected with proving or checking an identity before access is granted, refused or continued.

Typical entries include successful and failed sign-ins, password checks, multi-factor prompts, token use, session creation, account lockouts and logouts.

Avoid this assumption: That a successful authentication entry proves the named person entered the correct password and personally accessed the system. It does not necessarily prove any of those things.

Authentication may use a password, biometric, security key, one-time code, trusted device, session cookie, refresh token or single sign-on service. A successful event may represent the creation of a session, the reuse of an existing token or an automated service authenticating to another system.

The log can still be highly useful. It may show the account involved, the authentication method, result, source IP address, device information, application, location estimate, session identifier and timestamp. Several failed attempts followed by success may support one line of enquiry. A successful login from a new device or unusual network may support another.

But the record must be interpreted carefully. A source IP may be shared or routed through a VPN. Device information may be generic. Location may be inferred rather than measured. An MFA approval may have been accidental, coerced or obtained through social engineering.

Investigators should obtain the event definitions, authentication method and surrounding records. Ask whether the entry relates to primary login, token refresh, single sign-on, step-up verification or session continuation. Preserve session IDs, correlation IDs and the associated application logs where available.

Attribution should be supported through device evidence, communications, subscriber information, access patterns and other case material. Do not describe the event as the suspect logging in unless the evidence supports that conclusion.

Operational takeaway¶

An authentication log records an identity-checking event, but it does not by itself prove who supplied the credential, controlled the session or performed later activity.