Overview
Active recon is logged by the target, and testers should both expect this and keep their own records. This lesson covers logging from both the target's and the tester's perspectives.
Learning objectives
- Explain that active recon is detectable and logged.
- Describe the tester's own activity logging.
- Connect logging to detection, accountability, and reporting.
Core concept
Logging has two sides in active recon:
- Target-side logging — active recon generates traffic the target records (connection logs, service logs, security alerts). Testers must expect their activity to be visible to defenders, which is why coordination and timing matter.
- Tester-side logging — the tester keeps a record of their own activity (what they did, when, against which target). This supports accountability, lets the owner correlate test traffic with logs, and provides the factual basis for the report.
How it works
Because active recon touches the target, defensive systems log and may alert on it — so the engagement's communication/timing rules exist partly so defenders can distinguish sanctioned testing from a real attack. Meanwhile, the tester maintains their own timestamped activity log. This lets the owner correlate their logs with the tester's record (confirming which events were the test), supports accountability (a traceable account of actions taken), and feeds the report and any incident deconfliction. Keeping good logs is both professional discipline and a practical necessity.
Practical example
During authorized active discovery, the target's monitoring records the scanning traffic and may raise alerts. Because the engagement coordinated timing and contacts, the owner's team can match those alerts to the tester's activity rather than treating them as a real attack. The tester, in turn, keeps a timestamped log of what was scanned and when — so if the owner asks "was this event you?", the tester can confirm precisely. Logging on both sides kept the engagement transparent and accountable.
Cybersecurity relevance
Logging awareness is important on both sides. Expecting target-side logging/detection shapes how testers coordinate (timing, communication) and reminds them that active recon is not stealthy by default — useful knowledge for both offense and defense (defenders detect recon via these logs). Maintaining tester-side logs provides accountability, enables deconfliction (distinguishing test from real activity), and underpins accurate reporting. This dual logging discipline is a hallmark of professional, transparent engagements and connects to the evidence and reporting modules.
Common mistakes
- Assuming active recon is stealthy and will not be logged/detected.
- Not keeping the tester's own activity log, undermining accountability and deconfliction.
- Failing to coordinate, so the owner mistakes logged test traffic for a real attack.
Key takeaways
- Active recon is detectable and logged by the target, so testers coordinate timing/communication and should not assume stealth.
- Testers keep their own timestamped activity logs for accountability, deconfliction (matching test vs real events), and reporting.
- Dual logging awareness is professional discipline and supports transparent engagements, linking to evidence and reporting.
Check your understanding
- Why should a tester assume their active recon activity is being logged by the target?
- How does the tester's own activity log help the owner during and after the engagement?