Explain like I'm five · Security

What is a Log?

Logs, told as a story about the one-line diary kept at every door in the castle.

KitchenCounterVaultMailboxStudya door opened and closed; nobody wrote it down

Things happen in the castle and just pass.Who opened which door, and when — once it's over, nobody knows.

emptythe vaultwho was in here last night????nobody knows

When something goes wrong, there's nobody to ask."Who was in the vault last night?" — nobody knows.

KitchenCounterVaultMailboxStudy02:05 light on02:06 fridge opened14:02 note from Jimin14:03 apples 2 · ok02:10 door opened02:10 key: Jimin02:14 door closed01:40 letter arrived01:41 from: ?09:00 door opened09:00 key: Taeowhen, who, where, what — one line at every door, counter and thing

A log is the one-line record kept all over the castle.'When, who, where, what' — one line at a time. Every door, every counter, every thing.

Whenthe clocks must agree
Whoa person, or a thing
Whatdoor opened, note, letter
Did it worksuccess or failure
01:40 mailbox · letter · from ?02:05 kitchen · light on02:10 vault · door opened · key Jimin02:14 vault · door closed02:20 gate · out · big bagthe thief's trailmonths in a drawerone line alone, a story together

Gather the lines in time order, and they become a story.Alone, one line; together, the thief's trail. The big screen gathers and lines them up. Months of them go in a drawer.

(empty)a door nobody set to write→ no record at all02:10 vault…the thief tears the diary first→ send a copy far awaythousands a day→ no person can read themwhich is why the big screen reads them instead

Unwritten lines don't exist, thieves tear pages, and too many can't be read.A door writes only if it's told to. Thieves tear the diary first — so a copy goes far away. And thousands a day are beyond any person — the guard room's big screen reads them instead.

In one breath

A log = the one-line record — when, who, where, what — kept all over the castle. Gathered in time order, it becomes a story.

The first ingredient of any investigation. Four jobs: write it (configure), gather it (SIEM), protect it (send it away), keep it (retention). Start by setting the clocks.

When grown-ups say it

Event
One line. One thing that happened: a door opened, a letter came.
Timestamp
When. Every clock in the castle must agree, or nothing lines up (NTP).
Source
Where. Which door, which counter, which thing wrote it.
Audit log
Who changed what. Took a key, swapped a hat. → the key ledger
Access log
The list of counter visitors. Who handed in which note, when. → the note checker
Log forwarding
Sending a copy far away. Tear the diary and the copy survives. → the big screen
Retention
Months in the drawer. To find footprints later, keep them a long while. → the spare chest
Log tampering
Tearing the diary. A thief erasing only their own lines. Copies and stamps (hashes) prevent it.
Next story
A Dog in Every Room →
Want another term as a picture book? Request →