Audit Log Investigation
Design an investigation workspace that helps a security analyst trace a suspicious administrative change across actors and systems.
The brief
Understand the problem
Background
Audit logs can contain millions of events with different identifiers, timestamps, and data quality. Investigators need to preserve original evidence while narrowing a case and documenting interpretations separately.
User context
Security analyst Marcos is investigating a new administrator role assigned shortly before a large export. He needs to connect the role change, session, device, and export without altering source logs.
Product problem
The analyst needs fast filtering, relationship tracing, saved evidence, and a defensible case record with visible data gaps.
Objective
Create investigation setup, event exploration, linked-activity reconstruction, and evidence export for an access incident.
What to design
Define the experience
Required experience
- Start a case with scope and preservation settings
- Filter events by actor, action, resource, time, and source
- Link related sessions and administrative actions
- Save findings and export a verifiable evidence package
Screens and states
- Investigation overview
- Event explorer
- Activity reconstruction
- Evidence package
Core user flow
Follow the critical path
- 01
Marcos creates a case around the suspicious role assignment
- 02
He filters by user and resource, then expands to the associated session
- 03
A sequence view connects sign-in, role change, export, and revocation
- 04
He marks one inference, preserves source events, and exports a hashed case package
Product rules
Requirements and constraints
Requirements
- Keep raw events immutable and display source, ingestion time, and clock quality
- Support precise filters with visible query state
- Distinguish observed evidence from analyst notes and inference
- Record case access, evidence additions, and export integrity
Constraints
- Investigators can search only sources within their authorization
- Retention windows may create documented gaps
- Timezone conversion cannot replace original timestamps
Reality check
States worth considering
Ready-to-use content
Mock data
Use this content to test hierarchy and realistic data states. You can expand it when the concept needs more depth.
Case events
- 09:14 sign-in from new device
- 09:19 administrator role assigned
- 09:26 customer export started
- 09:41 role revoked
Evidence quality
- Identity log clock verified
- Export event arrived 4 minutes late
- Device identifier unavailable
Finish line
What to deliver
- Four desktop screens showing evidence, inference, and data-gap states
Optional direction
Visual resources
Use these as a starting constraint if you want one. They are not part of the required solution.