Which of the following statements about logs is true?

• A. They are optional
• B. They are a key component of the reporting aspects of Observe and Report
• C. They are only legal documents
• D. They are not used in security

Answer: (B)

Logs are records of events that create an auditable trail of what happened in a security environment, including who did what, when, and from where. This time-stamped, contextual data is essential for understanding incidents, monitoring activity, and supporting investigations.

In an Observe and Report framework, reporting relies on these logs to provide accurate, verifiable information about events. They give responders the ability to reconstruct sequences of actions, assess impact, determine root causes, and generate meaningful, defensible reports. Because of this, logs are a fundamental part of how security teams observe activity and communicate findings.

Logs aren’t optional; they’re actively used in security to detect anomalies, verify compliance, support forensic analysis, and drive improvement. They’re not only legal documents, and they aren’t unused in security—their practical value is in operational monitoring and reporting.