Detection Tools - Logs

• Logs may make little immediate sense without training in the operation of the intrusion detection tool and understanding the principles upon which it operates

• Logs may lack sufficient detail

• Logs may not cover relevant time periods

• Logs may not be sufficient to permit comparison of normal vs. abnormal activity