Logging the Alert Before Anybody Looks

The habit that most improves an insider programme is writing down what arrived before anybody decides what it means.

The distinction made in “Logging the Alert Before Anybody Looks” should also shape any workforce technology used near an investigation. When reviewers consult further details are available here for fireable offenses, its records can provide operational context, but a signal still needs validation, a stated threshold and a human decision before it becomes a finding.

The four fields

Source: automated rule, behavioural model, human report, downstream discovery, external notification. Which rule or which model, named.

For a separate perspective relevant to “Logging the Alert Before Anybody Looks”, consult the Cloudflare insider-threat overview. Use it to test the proposed threshold, investigation scope and review process rather than to substitute a generic checklist for the facts of a case.

What the system actually observed, in plain terms, without interpretation. Not suspicious data movement but a file of this size sent to this category of destination at this time.

Who received it and when.

And whether anybody has already formed a view, including the person who reported it. If a manager raised it saying they had concerns, that is part of the record and it is the part most often omitted.

Why before rather than after

A record written after the conclusion is shaped by the conclusion. The alert gets described in terms that fit what was eventually found, and nobody is being dishonest — it is simply how writing works.

Which means the file cannot later answer the question that matters most in a review: was the response proportionate to what was actually known at the time?

A contemporaneous record of what arrived is the only thing that can answer it.

The field that protects everybody

The one recording a pre-existing view.

A case that began because a manager was already unhappy with somebody is a different case from one that began with a rule firing, and the distinction affects how the evidence should be weighed.

Recording it is not an accusation against the manager. It is the context that lets a later reviewer judge the case properly, and it protects the manager too if the case is challenged.

What not to write at this stage

Any characterisation of the person.

Any inference about intent.

Any language implying a finding: suspicious, concerning, unauthorised. At this point nobody knows whether it was authorised.

The vocabulary note makes the general argument; here the specific instruction is that the first entry should be describable to the subject without embarrassment.

The test

Hand the opening record to somebody uninvolved and ask what they think happened.

If they come away with an impression of the person rather than of the event, the record is doing something it should not.

Four fields, two minutes, written before anybody thinks about it. It is the cheapest control in the whole programme.

The entry that cannot be written later

What was known at the moment the alert arrived, before anybody had an opinion. Reconstructed afterwards it is contaminated by the outcome, and the contamination is invisible to the person doing the reconstructing. This is the single field that a review cannot do without and the one most often absent.

Keeping it short enough to happen

Four fields, two minutes. A template that asks for twelve will be filled in badly or not at all, and a partial record of the opening is worth little. The discipline survives only if the cost of it is genuinely trivial.

Before anybody thinks about it

The value of the opening record is precisely that it is written before a view exists. Once somebody has an impression, everything they write is shaped by it without their noticing, which is ordinary and is why the sequence matters more than the content.

Describable to the subject without embarrassment

That is the test for the opening entry. If the first line of the record would make the person reasonably angry on reading it, the record has characterised them rather than described an event, and everything written afterwards inherits that framing.

Four fields and nothing else

Source, observation, recipient, prior view. Anything longer competes with the next alert and loses, and a partial opening record is worth considerably less than a complete short one.