What is the overall investigator checklist for logs, events, alerts and timelines?¶

The overall investigator checklist is a structured way to make sure log evidence is preserved, interpreted and reported without overstating what it proves.

It should be used from first receipt through to final reporting.

Avoid the dangerous assumption¶

The dangerous assumption is that once a log, alert or timeline has been obtained, the evidential work is largely complete.

It is not.

Start by identifying the source. What system created the record? Is it raw, exported, normalised, enriched, correlated or displayed through a SIEM?

Then establish what the event actually means. Check field definitions, event codes, result values, timestamp type, time zone and whether the record shows request, receipt, processing, completion or ingestion.

Identify the technical entities involved: account, device, session, application, service account, IP address, process and provider. Do not treat any one of them as automatic proof of a person.

Ask what may have generated the activity. Consider direct user action, automation, scripts, APIs, synchronisation, security software, remote access, administrator action and compromised sessions.

Check completeness. What logging was enabled? What retention applied? Were events filtered, overwritten, delayed, lost or held elsewhere? Preserve volatile records early.

For alerts, obtain the rule, version, logic, source events, severity basis and analyst disposition. Treat the alert as a detection outcome, not the underlying proof.

For timelines, preserve original timestamps, document conversions, show gaps and contradictions, and distinguish correlation from causation.

Finally, report proportionately. State what the system recorded, what supports attribution, what remains uncertain and which alternative explanations were considered.

Operational takeaway¶

A defensible log investigation checks source, meaning, time, identity, automation, completeness, alert logic, correlation and reporting, while preserving the distinction between technical activity and personal attribution.