Audit Log Service  ·  View 05 of 40  ·  2 · People and journeys

Journey — Trace an Account Through Thirteen Months

The investigator's path from an alert to a defensible timeline, and the moment where the tool stops being trustworthy to them.

Editable source SVG draw.io All views
Investigator Security incident response Goal — Establish who granted this role, under whose authority, and whether the record is complete Trigger — An alert: a service principal acquired Owner on a production subscription overnight Done when — A defensible timeline handed to the incident lead, with a stated completeness bound 1 · Suspect the alert lands 2 · Scope actor and window 3 · Search ◆ moment of truth 4 · Corroborate ◆ moment of truth 5 · Hand over to incident lead What they do Reads the alert Fixes actor + window Cites justification Queries by actor Widens to resource Checks denied too Pulls before/after Exports the range Where they do it Alert console Query console Query API Query API Export console Behind the glass Alertmanager RBAC scope check ClickHouse index Segment fetch Export service How it feels Confident Working Doubting Where it hurts Scope check is slow Is the index complete? Payload not in index What answers it Precomputed scope Completeness bound Fetched on demand Signed bundle Investigator — Trace an Account Through Thirteen Months The trough is at Search, and it is not about speed. The investigator cannot tell whether an empty result means nothing happened or the index has not caught up — which is why every result carries the sealed segment it is complete to. View 22. v 1.0 · owner Data & AI Global Practice · date 2026-09

The trough, and its answer

  • The low point is Search, and it is not about speed. The investigator cannot distinguish 'nothing happened' from 'the index has not caught up', and an audit tool that cannot tell those apart is worse than useless in an incident.
  • Answered by a completeness bound on every result: the query states the sealed segment it is complete to, so an empty result is an empty result up to a named point in time rather than a shrug. Views 22 and 28.
  • Second pain: the payload is not in the index. Answered by an on-demand segment fetch for the page being read, which keeps the index cost proportional to the fields people filter on rather than to the bytes they occasionally open.

What the platform owes each phase

  • Scope: a precomputed RBAC scope so an investigator is not waiting on an authorization round trip per page.
  • Search: partition pruning by tenant and time before any scan, and a stated query budget so a 13-month scan cannot silently become a cost incident.
  • Hand over: a signed bundle rather than a CSV, because the timeline is going somewhere it will be challenged.

Assumptions

  • Investigators work inside a scope granted per matter, not standing tenant-wide read. The justification reference is mandatory and is stored on the read record.
◀  Actors and Their Core Journeys All views Journey — Verify Without Trusting the Operator  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source05-journey-investigation