Overview
Logs — of the tester's own activity and from the target — are an important form of evidence, providing a detailed record. This lesson covers logs in evidence collection.
Learning objectives
- Explain the role of logs as evidence.
- Distinguish tester activity logs from target logs.
- Connect logs to accountability and correlation.
Core concept
Logs provide a detailed, chronological record relevant to findings and the engagement. Two kinds matter: the tester's own activity log (what they did, when, against which target — for accountability and deconfliction), and target-derived logs or output captured as evidence for specific findings (e.g. output demonstrating an issue). Logs complement other evidence by providing detail and sequence, and — for the tester's activity log — a record that lets the owner correlate test activity with their own monitoring.
How it works
The tester maintains a timestamped activity log throughout the engagement (as introduced in the active-recon logging lesson), recording actions and their times. For specific findings, relevant output or captured records serve as detailed evidence of what occurred. These logs support accountability (a traceable account of the tester's actions), deconfliction (matching the tester's log to the target's logs to distinguish test from real events), and detail (a granular record beyond a single screenshot). Logs used as evidence are handled responsibly (sensitive data minimized) and tied to findings with timestamps. Together with screenshots and reproduction steps, they build complete, high-quality evidence.
Practical example
The tester's activity log records each action with a UTC timestamp; when the owner sees alerts in their monitoring, they correlate to this log and confirm which were the test (deconfliction) and which, if any, were not. For a specific finding, the tester also captures the relevant output demonstrating the issue as detailed evidence. Both kinds of logs — the tester's activity record and the finding-specific output — are timestamped, tied to findings, and handled responsibly, strengthening the evidence package.
Cybersecurity relevance
Logs are valuable evidence for accountability, correlation/deconfliction, and detail. The tester's activity log is essential for distinguishing authorized testing from real attacks in the owner's monitoring (a professional and safety necessity), and finding-specific output provides granular proof. This reflects the logging discipline from the active-recon and Linux monitoring lessons, applied to evidence. In broader incident response and forensics, logs are the backbone of reconstructing events. For assessments, well-kept logs support credible, correlatable evidence and transparent engagements. Responsible handling of any sensitive data in logs remains required.
Common mistakes
- Not keeping a tester activity log, undermining accountability and deconfliction.
- Capturing logs with sensitive data unredacted/over-collected.
- Untimestamped or disorganized logs that can't be correlated or tied to findings.
Key takeaways
- Logs provide detailed, chronological evidence: the tester's own activity log (accountability, deconfliction) and finding-specific target output (detailed proof).
- The activity log lets the owner correlate test activity with their monitoring to distinguish test from real events.
- Logs complement screenshots/reproduction steps for complete evidence; keep them timestamped, tied to findings, and responsibly handled (sensitive data minimized).
Check your understanding
- What are the two kinds of logs relevant as evidence, and what does each support?
- How does the tester's activity log help distinguish authorized testing from a real attack in the owner's monitoring?