What questions should I ask the person who supplied the logs?¶

Establish who created the source records, who produced the export, the search and time basis, every transformation, field meaning, completeness and retention risk.

Reconstruct production¶

Ask whether data came directly from a device, server or application or through a SIEM, dashboard or spreadsheet. Record date range, zone, clock synchronisation and whether each time is event, receipt, processing, ingestion or display. Capture filters, exclusions, sampling, deduplication, enrichment, translation and manual selection.

Define fields and gaps¶

Ask what important account, endpoint, status and action fields mean and whether hidden or renamed fields exist. Establish logging settings, rotation, licensing, outages, configuration changes and surrounding availability.

Identify who can provide source data, documentation and related records. Preserve answers and query settings, and seek direct source and specialist interpretation where evidence is contested.