Why should field definitions be requested?¶

Definitions establish what a value represents, which system created it and what conclusions it supports. Familiar labels such as user, source, success and time are not universal.

One heading can hide several meanings¶

“User” may be authenticating, executing or approving account. “Source IP” may be endpoint, proxy or translated address. “Success” may cover request acceptance rather than outcome, and a timestamp can be event, receipt or display time. Blank, zero and display names also need product meaning.

Preserve the interpretation basis¶

Request vendor or system documentation, schema or administrator explanation for fields affecting identity, action, time, sequence or result. Determine whether a platform renamed, normalised, enriched or derived the value and retain the rule and documentation relied upon.