What is a security incident log, and why is it important?

• A. Not useful for audits or investigations.
• B. A diary of employee lunch breaks.
• C. A log of only successful events.
• D. A chronological record of security events used for investigation, trend analysis, and regulatory/compliance evidence.

Answer: (D)

A security incident log is a chronological record of security events that captures what happened, when, where, who or what was involved, the impact, and the actions taken. This kind of log is essential for investigations and forensics because it lets responders trace the sequence of events, determine root causes, containment steps, and accountability. It also supports trend analysis, allowing you to spot recurring issues, attacker patterns, or control gaps so you can improve defenses. In addition, it serves as regulatory and compliance evidence, since many standards require detailed, time-stamped records to demonstrate monitoring, detection, and response. A good log should include details like event type, timestamps, affected assets, user identities, source and destination information, outcomes, and remediation actions, and it must be protected against tampering. It isn’t just a diary of lunch breaks, and it isn’t limited to only successful events.