Updated 2026-11-13
Comparing Logs to Find Investigative Leads #
A relationship between observations does not establish a cause or an attack.
One alert may provide too little context. The original cross-system log review offers lessons about comparing information from several sources.
Align subjects and time #
Before comparing records, check the subjects, timestamps and collection coverage. Missing or delayed data can affect the apparent relationship.
Treat relationships as leads #
Changes occurring together do not by themselves establish a common cause or attack. Seek further evidence and retain the limits of the interpretation.
Consider impact before responding #
When using analysis to guide a response, check its scope and effects on legitimate use. More observations do not automatically establish better accuracy or defensive effectiveness.
The lessons from the original case have been reorganized for this public article. See the BASTION introduction for current features and deployment conditions.
