Innomerc Learn
English is the default.
A worked example

An event is useful only if the evidence arrives.

One exchange at a time. Read what changes, then explain it in your own words before moving on.

  1. Meet the components
  2. Follow the steps
  3. Compare an example
  4. Check your understanding
Interactive Lab

An event is useful only if the evidence arrives.

Example: a fictional service records a failed sign-in. Follow its journey to an analyst.

Steps1. Failed sign-in 2. Search result 3. Check context
Click a box or choose its name to learn what it means.
Sign-in serviceReadyLog collectorReadyAnalystReadySign-in serviceReadyLog collectorReadyAnalystReady
Ready to traceRecord received
Before you start · 3 stepsRecord received

The analyst starts with an observation and looks for context before judging intent.

How to use this example

Select Next step to read at your own pace, or Animate step to watch one exchange. Nothing advances until you choose.

Inspect components & read every step
  • Sign-in service

    The system handling attempts to enter an account.

    Example: It records whether a sign-in succeeded or failed.

  • Log collector

    A system that receives and stores event records for later examination.

    Example: It collects failed sign-in events with their times and source context.

  • Analyst

    A person examining evidence to understand what happened.

    Example: An analyst checks related events before deciding whether a failed sign-in is suspicious.

Record received

The analyst starts with an observation and looks for context before judging intent.

  1. Sign-in service Log collector: Failed sign-in. The event includes a time, account identifier and recorded outcome.
  2. Log collector Analyst: Search result. The analyst can retrieve the event with its source context.
  3. Analyst Log collector: Check context. The analyst checks related events and alternative explanations.

Collection interrupted

An empty search result cannot rule out an event when collection is broken.

  1. Sign-in service Log collector: Delivery fails. The service emits an event but the collector does not receive it.
  2. Analyst Log collector: Search. The analyst searches the central system for the event.
  3. Log collector Analyst: Health warning. A collection-health check reveals missing telemetry.

Fictional teaching trace. One moving dot represents an exchange, not a measured network capture.