Logging and Detection Capability Audit

Assess whether your logs and alerts would catch a suspicious sign-in, mass deletion or new admin account, and who would notice.

Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made

The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.

[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it (what [VERIFY] means).

Assess detection. Log sources and retention: [LOG_SOURCES]. Alerts configured: [ALERTS]. Who watches them and when: [MONITORING_HOURS]. Past incidents and how they were found: [PAST_INCIDENTS].

For key scenarios such as a suspicious sign-in, mass file deletion, a new admin account and data sent to an unknown place, ask whether a log exists, whether an alert exists, who sees it and how fast. Rate coverage as strong, partial or none and note blind spots.

Return a scenario table, prioritised improvements and a monthly test routine. This is a defensive review; do not provide ways to evade detection.

Add a worked scenario table with invented ratings. Scenario: sign-in from an unusual country; log: yes; alert: no; who sees it: no one; result: gap, add an alert for sign-ins from new locations. Scenario: mass deletion of files; log: partial, only for one system; alert: none; gap. Scenario: new administrator created; log: yes; alert: yes to the lead, response within the hour; strong. Scenario: large data download by one account; log: no; gap; high priority. Coverage score: 1 strong out of 4 scenarios, 25 percent. Prioritise improvements: enable missing logs, route alerts to a shared mailbox watched by two people, define response steps, and test each alert by creating a safe test event. Describe log retention and protection: store logs separately so an intruder cannot erase them, keep them for the period needed by policy or law [VERIFY], and restrict access. Add a monthly test where someone triggers a harmless event and checks that it is detected and escalated within the target time. Remind me that this review is defensive and that I should test only systems I own, with permission and a safe plan.

Add a closing note on ownership: each alert has a named responder and a deputy, response targets are written down, and the alert list is reviewed every quarter to remove noise. Suggest a simple register of detections with the date added, the scenario it covers and the date last tested.

Fill in before use

Optional: type your details and the prompt above updates. Nothing is saved or sent.

Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.

Invented scenarios.
Sign-in from an unusual country: log yes, alert no, nobody watching. Gap.
Mass file deletion: log partial (one system only), alert none. Gap.
New administrator created: log yes, alert yes to the lead, response within the hour. Strong.
Large download by one account: no log. Gap, high priority.
Coverage: 1 strong of 4 scenarios = 25 percent.
Improvements: enable missing logs; send alerts to a mailbox watched by two people; test each alert with a safe event; keep logs separate for the retention period [VERIFY].

• audit