Tools · Incident response playbooks · 27 / 27
One quoted log line is not the source log
A pasted line is that line. The source system and the query are other fields. Do not call one line the whole log.
The quote is one row
A line pasted into the ticket is the text someone copied. It supports that those words were copied. It does not show the rows above or below it, and it does not show how the search was filtered.
Keep the quote in quotes. A paraphrase can drift. If you paraphrase, say so, and keep the original line too.
The system and the query are separate
The source system is where the line came from, if the note names it. The query or the time window is how the line was chosen, if that was written down. Neither is implied by the quote.
If the system name is missing, write that the source was not named. Do not guess a product from the shape of the sentence.
What a complete citation includes
File the quoted line, the source system if known, and the window or query if known. Say the rest of the log was not pasted. A timeline built from one line is a timeline of one line.
Lab: one failure line treated as the whole log
The ticket quotes: 2026-11-02T09:40:00Z lab-web-02 failed interactive logon. No source system and no query are written. A draft says the auth log contains only that event.
The note keeps the quote as one line. Source system: not named. Other rows: not pasted. The draft claim that the log contains only this event is removed.
quote: 2026-11-02T09:40:00Z lab-web-02 failed interactive logon source system: not named query or window: not written other rows: not pasted write: one quoted line not: the log contains only this event
Diagram
A quote is one row of a larger log
The line you can see is the line that was pasted.
Quoted line
2026-11-02T09:40:00Z failed interactive logon
The text in the ticket.
Source system
not named
Where it came from, if written.
The rest
not pasted
Rows you have not seen.
Check yourself
1. The ticket quotes one log line and nothing else from that system. What do you have?
2. The note does not name the source system. What do you write?
3. No other rows were pasted. What can you say about the rest of the log?