Audit Gap

Korgan Insurance JSC is an insurance company. Monitoring sent a single event: the audit log on the server KOR-SRV-CRM was cleared. The alert says nothing else.

The clearing event itself cannot be deleted — it is written into the new, empty log. That is your starting point: it carries the time, the host and the account. The rest is reconstructed from what survived: some of that account's records reached the log before the wipe.

Timestamps are UTC; the office runs on Astana time (UTC+5), so the working day is roughly 04:00–13:00 UTC.