  Effective activity and event monitoring is an essential aspect of digital
forensic readiness. Techniques for capturing log and other event data are
familiar from conventional networked hosts and transfer directly to the Cloud
context. In both contexts, a major concern is the risk that monitoring systems
may be targeted and impaired by intruders seeking to conceal their illicit
presence and activities. We outline an approach to intrusion monitoring that
aims (i)~to ensure the credibility of log data and (ii)~provide a means of data
sharing that supports log reconstruction in the event that one or more logging
systems is maliciously impaired.
