In every post-incident investigation the first question is the same: who made this connection? If all you have is 10.20.7.42, the work has just begun. Which computer had that address at that time? Who was signed in? When did the DHCP lease change? The records live in different systems, in different time zones, and are often incomplete.
Why records should name a person
Log retention laws such as Turkey's Law 5651 expect organizations to keep access records from their internal networks for a set period and to prove those records were not altered later. Beyond audits, the real need is operational: when an alert fires, the security team has to know who to talk to.
When NameDefence records each DNS query, it maps the client IP to a user and computer name:
- Computer and user mapping via Active Directory or LDAP
- User name on devices joined to Microsoft Entra ID
- The signed-in user reported by the endpoint agent on laptops outside the network
- Lease records and device fingerprints from the built-in DHCP server
So the log line does not say "10.20.7.42"; it says "CORP\ayse.yilmaz, ACC-PC-14". User analytics work from this stamp rather than IP history, so even if a person's DHCP address changes during the day, their queries show up in one place.
Timestamped archive
Keeping records is not enough; you need to show they were not changed afterwards. NameDefence writes daily DNS and DHCP records to compressed archive files and has each file's digest signed by an RFC 3161 timestamp authority. The stamp proves the file existed with this content on that date; change a single byte and verification fails.
Archives are kept for the period you set and expired ones are deleted automatically. Any timestamp provider your organization works with can be used.
Reports
When audit time comes, you need a readable report, not raw logs. Ready report templates for KVKK, ISO 27001 and BDDK show in one document how controls such as log retention, access, monitoring and web filtering are met in the product.
In short
An IP address is not a person. Record the person, seal the archive with a timestamp, and both investigations and audits take minutes.