# Network, DNS and cross-source correlation · Case scope and collection authority

Blank workpaper, not completed testing or approval. Do not include secrets or real personal data.

## Case ID / record revision / scope

[ ] Complete; add evidence and owner.

## Written authorization, scope and stop contact

[ ] Complete; add evidence and owner.

## Identity / tenant / host / data source

[ ] Complete; add evidence and owner.

## Assumptions / prerequisites / exclusions

[ ] Complete; add evidence and owner.

## Module-specific evidence

- Source/entity/time correlation matrix
- Direction, coverage and benign-alternative record