Understand United Logs and Incident Recovery

A useful security log answers four questions: what changed, who caused it, what United did, and what still needs attention. Recovery should begin only after those answers are clear.

Use Bot Logs as the source of truth

Bot Logs is the default destination for United activity. It can receive moderation actions, member joins and leaves, message changes, role and channel updates, protection events, dashboard changes, ticket actions, and setup repairs. This gives a new server one place to verify before creating specialized routes.

Dedicated log channels are overrides. For example, a server can keep all events in Bot Logs but send ticket transcripts to a private archive and Anti-Nuke events to senior staff. If an override channel is removed or inaccessible, the dashboard should warn about the saved ID rather than silently losing the event.

Differentiate the event actor from United

When someone uses a United command, the moderator is the person who invoked it. United is the application that executed the Discord API request. A clean record lists the responsible moderator once; it does not list every author whose message happened to be removed during a purge. For native Discord actions, United reads the relevant audit-log entry and labels the Discord account that performed it.

Audit attribution is not magic. Discord may delay an entry, omit context, or deny View Audit Log. If United cannot identify a responsible user with confidence, it should record Unknown and avoid punishing a guessed actor.

Prevent duplicate records

A command-based timeout can be observed twice: once when United performs it and again when Discord emits the member update. United correlates those paths so staff receives one normalized moderation record. Similar deduplication applies to channel deletion and other events where security, logging, and audit systems could otherwise report the same action independently.

Read Incident Mode in order

1. Active events: Review the destructive actions that remain unresolved.
2. Responsible user: Confirm the audit-log actor before using Ban, Kick, or Strip Roles.
3. What United did: Check whether enforcement completed, failed permission checks, or remained log-only.
4. Snapshot comparison: Distinguish missing structure from renamed or permission-changed structure.
5. Recovery state: Confirm whether a lockdown has saved channel overwrites available to restore.

Know what Restore changes

Restore is conservative. It recreates snapshot channels, categories, or roles that are missing and repairs altered permission overwrites where United has enough information. It does not delete unrelated channels created after the snapshot. A normal channel rename, including Scam Trap's daily name rotation, should update or be accepted by snapshot logic rather than remain a permanent incident.

When manual review is required

Manual review is appropriate when no actor can be attributed, a lockdown flag exists without saved overwrites, Discord role hierarchy prevented enforcement, a missing item was intentionally deleted, or restoring an old permission layout would conflict with a deliberate server redesign. United should describe the limitation instead of claiming a repair succeeded.

Build a practical retention routine

Keep Bot Logs readable by using dedicated routes only for high-volume or sensitive records. Restrict transcript channels to staff who need them. Review broken saved IDs after deleting roles or channels. Preserve database and source backups separately from Discord logs, because a Discord channel is an activity record, not a full bot recovery plan.