What is the difference between a source event and a dashboard entry?¶

A source event is created by the original system. A dashboard entry is another product's presentation, which may parse, rename, convert, enrich, correlate or summarise it.

Row count and meaning can change¶

One dashboard row may group several source events, and one event can appear in several views. Empty fields may be hidden, duplicate records suppressed, time zones converted and current identity data attached to older activity. Display time may differ from event or ingestion time.

Preserve both view and underlying record¶

Identify source product and display platform and whether the entry is raw, normalised, enriched or correlated. Retain source event, mappings, linked IDs, search filters and zone settings.

Screenshots show what an investigator saw; underlying records support technical conclusions and reproducibility.