System for Preparing Source-Linked Incident Summaries from Security Logs

The problem

In day-to-day operations, timestamped logs and asset and identity records arrive through different systems and event records, preventing the team from seeing the case on a single timeline.

As a result, source links can be lost while the draft incident timeline is prepared, the case can be routed to the wrong team, and the basis for the technical decision can remain unclear.

An incomplete workflow may overlook a time difference, missing log or identity conflict, while an incorrect system action could establish an inaccurate incident chain.

What we set out to improve

• Time taken for the draft incident timeline to be ready for specialist review
• Correct referral of records involving a time difference, missing log or identity conflict to the appropriate specialist queue
• Record of recommendations corrected or rejected by the incident response analyst

How the system works

1. 01 Retrieve timestamped logs and asset and identity records from authorised sources
2. 02 Verify the source, timestamp and record identifier
3. 03 Add the relevant asset, user, shop, vehicle or content context
4. 04 Prepare the draft incident timeline
5. 05 Compare the draft with technical rules and authority boundaries
6. 06 Check for exceptions: a time difference, missing log or identity conflict
7. 07 Obtain the incident response analyst's approval, correction or rejection
8. 08 Write the input, recommendation, changes and final decision to the audit log

Methods we used

• Source- and time-traceable data extraction for timestamped logs and asset and identity records
• Structured output that restricts the incident timeline fields to technical rules
• An exception gate that separates cases involving a time difference, missing log or identity conflict from system action
• An authorised queue that presents the evidence and recommendation together for the incident response analyst
• Duplicate-processing controls and a rollback record to address the risk of establishing an inaccurate incident chain

Where people stay involved

Data and security

Only fields required for the task are processed from timestamped logs and asset and identity records. Source-system permissions are preserved, and unnecessary personal, technical and security-sensitive data is minimised before being sent to the model. Every retrieval, recommendation, human change and target-system action is written to the audit log.

Who this suits

Frequently asked questions