Does a username in a log identify the user?¶

No. It identifies the account or identity label the system associated with the event, not necessarily the person operating it at that moment.

The field may mean several things¶

It can be login name, account owner, display name, executing identity, impersonated identity or approver. Names can be reused, abbreviated or substituted during export, and shared accounts, stolen credentials, saved sessions, delegated permissions, scripts and scheduled tasks complicate use.

Resolve account and session control¶

Preserve the stable internal account ID and establish field meaning. Examine authentication method, multi-factor events, addresses, endpoints, session creation, token use, privilege changes and remote access, then compare employment, possession and communications.

Report the account used and the evidence identifying its operator separately, particularly where delegation or compromise is realistic.