Most organisations discover their logging gaps during an incident. A short assessment beforehand changes what an investigation can establish.