This synthetic review compares L01, L02, and L03 at noon UTC on October 14, 2026. L01's 11:45 receipt is fifteen minutes old; L02's 09:00 receipt is 180 minutes old; L03 has no supplied receipt. Under the example's sixty-minute window, one of three sources is observed within the window. The HTML view filters those states and recalculates ages when the review timestamp changes.
Begin with the declared roster
Each expected source needs a unique ID, log type, and owner. Here the types are synthetic A, B, and C, and all owners remain unconfirmed. L03 stays in the denominator of three even though it lacks evidence.
The historical NIST SP 800-92 log-management guide discusses monitoring logging status across log sources. This worksheet uses that general organizational idea. Its sixty-minute rule is illustrative and operator-defined, not a threshold prescribed by NIST or a current compliance determination.
The source roster answers what you expected to inspect. Receipt records answer what evidence you have. One source with several receipts still counts as one declared source, so receipt-row counts cannot replace the roster count.
Calculate the age of the receipt
Use review time minus collectorReceivedAt. At 12:00 UTC, subtracting 11:45 gives fifteen minutes, and subtracting 09:00 gives 180. A valid age from zero through sixty minutes inclusive is Within window. Older valid evidence is Older than window.
R01 belongs to L01 and R02 to L02. Both are fictional receipt references, not working artifact links or inspected production logs. L03 has no timestamp, so its age remains Unknown rather than zero.
The timestamp describes when a collector received material. It is not an event-generation timestamp. A recent receipt does not establish clock agreement, complete event arrival, or the absence of suspicious activity.
Change the snapshot deliberately
Set the review timestamp to 13:00 UTC and recalculate. L01 becomes seventy-five minutes old and L02 becomes 240 minutes old. Neither falls within sixty minutes, so the summary becomes zero of three within window, two older, and one unknown.
That is a new snapshot using the same supplied receipts. It does not prove that either source stopped sending data; newer evidence may simply be absent from this sanitized example. The review question is which authorized receipt should be inspected next.
Use Older or Unknown filters to focus the row list. Keep the full-roster summary and snapshot label visible. Filtering to L03 should not replace the declared three-source base with an unlabeled one-source security score.
Hold invalid evidence for review
A review time before L01's supplied receipt makes that receipt future-dated relative to the snapshot. Withhold the affected classification and explain the timestamp conflict. A malformed review time clears stale ages instead of leaving the previous summary beside an error.
Unknown evidence is an open question, not a safe state. For L02, verify the latest authorized receipt. For L03, identify the owner and locate the missing evidence. Keep actual response references in the maintained worksheet rather than inventing failures or attacks from freshness labels.
Copy this prompt
Create a self-contained US-English HTML logging-source evidence review, clearly labeled synthetic. Use a restrained operations layout with readable roster rows, a full-roster summary, UTC snapshot control, and textual evidence states. Text is at least 16px and the view fits 360px. No remote dependencies, live feeds, credentials, scanning, storage, or notifications.
Declared roster is L01 synthetic type A, L02 type B, L03 type C; owners TO CONFIRM. Snapshot default is 2026-10-14T12:00:00Z. R01 for L01 has collectorReceivedAt 2026-10-14T11:45:00Z. R02 for L02 has 2026-10-14T09:00:00Z. L03 has no supplied receipt. These IDs are fictional references, not actual inspected logs.
Calculate age as review time minus collector receipt time. An illustrative operator-defined 60-minute inclusive window classifies valid ages 0..60 as Within window; older ages as Older; absent evidence as Unknown. Default ages 15 and 180 minutes give 1 of 3 within, 1 older, 1 unknown. Never infer zero events, safety, failure, or compliance from those states.
Provide a labeled UTC timestamp text input and type=button Recalculate, plus All/Within/Older/Unknown filters. Keep the declared-roster denominator three while filtering. At 13:00 UTC ages become 75 and 240, producing zero within and two older. Invalid timestamps clear stale results; future receipts receive a review-problem label and are withheld from valid classifications.
Include Reset and source-level notes distinguishing collector time from event time. No operational actions or current security assessment. Native roster and verified operator records remain authoritative. Return complete accessible HTML with explicit selectors and visible focus.
Use the HTML review only for sanitized preparation. NOS can preview it as a page so an operator can read the roster and age calculations together. Before making any operational decision, return to the actual roster and evidence records and resolve the specific gap for each source.