For each event logged, the application should capture enough information to reconstruct what happened in the event of an intrusion.