The need to look back over previous event logs which they have saved. Need to have a tool ingest these and report on logons/logoffs etc.
