Week 13: Logs Are Evidence With Context

A log line is not the event itself. It is a record produced by a component according to its code, configuration, clock, permissions, and logging policy.

This week teaches students to treat logs as structured evidence rather than magic truth. You will trace event fields, timestamps, sources, correlation IDs, missing data, normalization, and retention, then build a small evidence timeline from multiple fictional systems.

This week

1. A Log Records a System's View — identify source, event, fields, timestamp, and limitations.
2. Correlation Builds a Stronger Timeline — connect application, identity, and network/service events without collapsing them into one source.
3. Missing Logs Are Also a System Condition — reason about gaps, clock skew, forwarding failure, retention, and evidence quality.

Evidence artifact

Create a Telemetry and Timeline Record containing source inventory, event dictionary, normalized fields, multi-source timeline, one conflicting/missing observation, a confidence statement, and evidence-retention requirement.