Close window
Close windows with source, time zone, sequence range and record count; flag clock skew.
MOBILE-ID · TRUSTED LTANS
Security / System Log Preservation
Seal log windows with source sequences and detect gaps or duplicates before creating evidence.
Problem and records to preserve
Open log streams change; missing or duplicated events distort reconciliation.
SYNTHETIC CASE
Synthetic log window
LOG-SYN-001| Element | Illustrative scope |
|---|---|
| Decision makers / users | SOC, information security and system-audit teams |
| Source system | SOC / source systems |
| Revision | Retain time zone, source and order; supplementary batches do not hide old gaps. |
| Record relationship | Late batches have new IDs linked to closed windows. |
Sector-specific record journey
Retain source order
Retain source-guaranteed ordering; distinguish sequence gaps from late arrivals.
Seal
Hash files/inventory after sensitive-data minimization; corrections create new batches.
Preserve
Preserve closed batches with evidence/access controls; LTANS is not a real-time SIEM.
Trace batch
Trace events/cases to batches, files and evidence; identify data outside closed windows.
Delivered artifacts
| Recipient | Artifact |
|---|---|
| Source system | Intake receipts, source/revision-to-archiveId/jobId mappings and per-item errors. |
| Package recipient | Batch manifest, source sequence ranges, archiveId mapping and gaps/duplicates. |
| Record owner / operations | Completed/outstanding inventory, applied decisions and report references; no automatic legal conclusion. |
Rights, retention and deployment
Remove secrets before sealing; access is case-scoped.
Distinguish ingest traffic, record count and retained bytes for pricing and performance.
Retention authority and exit
The owner must approve the retention authority and trigger for this record class: A closed log window with source sequence range and checkpoint.
Sample dossier and tests
Synthetic text files exercise inventory and hashing; they are not signed contracts, real records or ERS/XMLERS.
Download synthetic dossier| Test | Expected outcome |
|---|---|
| Intact | File inventory, size and SHA-256 match the manifest. |
| Missing / changed bytes | The verifier rejects the package without claiming inventory success. |
| Sector business case | Gaps, duplicates and supplemental batches produce three distinct outcomes. |
Scope a PoC for this dossier
Test sequence gaps, duplicate batches and clock skew; never report completeness before reconciliation.
Prepare a sector-specific requestFinalization point and specific acceptance
| Control point | Requirement |
|---|---|
| Source event | A closed log window with source sequence range and checkpoint. |
| Revision / decision | Retain time zone, source and order; supplementary batches do not hide old gaps. |
| Test and expected result | Detect missing/duplicate sequence entries, not merely correct hashes of present files. |
Sample inventory/hashing checks bytes only. Authorization, decision and state cases must run in the provisioned test environment before business acceptance.
Source-system handoff record
| Information | Value / decision |
|---|---|
| Record | LOG-SYN-001 |
| Source system | SOC / source systems |
| Revision relationship | Late batches have new IDs linked to closed windows. |
| Recipient and output | Batch manifest, source sequence ranges, archiveId mapping and gaps/duplicates. |
| Rights and authority | Remove secrets before sealing; access is case-scoped. |
| Required rejection test | Gaps, duplicates and supplemental batches produce three distinct outcomes. |
Sector information is source business metadata, not automatically new REST fields. Agree field mapping and ownership before a PoC.