Identity incidents are structural events: memberships appear, privileges escalate through groups, licenses activate services. Responders reconstruct what changed and when, and the speed of that reconstruction is set by whether historical states exist or must be rebuilt from event logs mid-incident.
The three states responders need#
Every structural incident question reduces to comparing states:
- Before: the last known-good structure, establishing what normal looked like.
- During: what changed in the incident window, as a complete diff rather than sampled events.
- After: confirmation that remediation returned the structure to intended state, and only that.
Why event logs alone are slow under pressure#
Audit events are the forensic record of who acted, and correlating hundreds of membership events into a coherent picture of structural change is exactly the work nobody has time for during containment. A diff between snapshots yields the same picture in one operation, and the events then explain attribution for the changes the diff surfaced.
VisualizerEngine
How VisualizerEngine helps
Scheduled snapshots mean the before state always exists, diffs produce the complete change list for any window, and the change-history panel with alerts shortens detection in the first place. The platform's own HMAC-chained audit trail keeps the investigation's reads tamper-evident, which matters when findings reach lawyers.