iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Investigate suspected misuse as a timeline, not as a single “AI log” search. Preserve the alert and original records first; identify the AI product, user, host and referenced resources; correlate that interaction with identity, cloud control-plane, data-access and endpoint telemetry; then escalate to prompt or response content only when metadata cannot answer the question. This method separates observed facts from an assistant’s hypotheses and makes retention, permissions and missing evidence explicit.
What a defensible investigation must establish
A useful case record answers five questions:
- Who: Which human, service account or delegated identity used the AI security tool?
- When and from where: What were the interaction time, tenant or project, host application, device and source sign-in context?
- What was referenced: Which cloud resources, files, alerts, cases, identities or configurations were included?
- What happened next: Did the interaction coincide with reads, permission changes, deployments, policy denials, downloads, processes, network connections or response actions?
- What cannot be proved: Which fields, content, devices, services or time periods were unavailable because of configuration, retention or permissions?
No universal log answers all five. AI audit records commonly provide interaction metadata, while cloud and endpoint systems provide the surrounding activity. Prompt and response text is a separate evidence layer.
1. Preserve the event before changing anything
Start with the alert, report or analyst observation. Record the suspected users and service accounts, affected endpoints and cloud resources, the AI product or agent, and an initial time window with its time zone. Export or otherwise preserve the underlying records and their original timestamps before changing logging, revoking access, deleting a case or taking a disruptive response action.
Preservation checklist
- Save the alert identifier, source, severity and first-observed time.
- Record tenant, subscription, account, project, region and device identifiers in scope.
- Capture the exact query, filters, time boundaries and analyst identity used for each search.
- Keep original exports and a working copy; note collection time and any conversion or normalization.
- Document retention, routing, exclusions and permissions before concluding that an event is absent.
This sequence is investigative guidance rather than a guarantee that every product exposes the same fields. Avoid disabling an account or isolating a device until the records needed to explain the event have been preserved, unless an approved incident procedure requires immediate containment.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
2. Establish the AI interaction
Microsoft environments: identify the product and host
In Microsoft Purview Audit, filter for the relevant AI operation, operation name, record type and workload. Inspect the user, event time, app identity, host application, activity type and resource references when those fields are available. “Copilot” is not one uniform event source: cloud-management and security-operations experiences can produce different records. Identify the specific assistant and host context before interpreting an event.
For Security Copilot, Unified Audit Log records are described as administrative events and activity metadata. That metadata can show who interacted, when and which resources were referenced, but it may not contain the prompt or answer. A separate content-review capability, such as DSPM for AI or Purview eDiscovery where configured, may be required for prompt, response or memory content.
Fields to capture
| Field | Why it matters |
|---|---|
| User or service identity | Connects the interaction to sign-ins, roles and expected duties. |
| Event timestamp | Provides the join point for cloud and endpoint timelines; preserve the original time zone or UTC conversion. |
| App identity and host application | Distinguishes the AI assistant and the surface that invoked it. |
| Activity or operation | Indicates whether the record is an interaction, administrative action or another activity type. |
| Resource references | Identifies alerts, cases, files, subscriptions, projects or other objects the tool referenced, where exposed. |
Microsoft documents 180-day retention for specified pay-as-you-go audit logs covering non-Microsoft AI applications. Treat that as a product-specific boundary, not a universal Microsoft, tenant or AI-service retention period.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall3. Correlate identity and cloud activity
Use the AI event as a pivot into sign-ins, role and permission changes, API operations, data reads, policy denials and system-driven changes. Build a timeline with a consistent clock and distinguish user-driven actions from service activity.
Google Cloud log categories
| Log category | What it records | Investigation use |
|---|---|---|
| Admin Activity | User-driven changes to configuration or metadata. | Check whether the identity changed IAM, resources, settings or deployment metadata after the AI interaction. |
| Data Access | Reads and user-driven operations on resource data. | Determine whether referenced data was actually read or modified. |
| System Event | System-driven changes. | Separate platform behavior from a user or assistant action. |
| Policy Denied | Requests rejected by policy. | Find attempted access that failed and identify controls that blocked it. |
Admin Activity and System Event records are always written. Data Access logging is disabled by default for most services except BigQuery, and enabling it can add log-usage charges. Policy Denied entries are generated by default, but exclusions can prevent their storage. Check service-level settings, sinks, exclusions and retention before treating a quiet period as proof that no data access occurred.
Identity questions to test
- Was the account signed in interactively, through a workload identity or by delegated access?
- Did its roles or group membership change immediately before the AI interaction?
- Does the resource scope match the person’s job and normal operating window?
- Did a denied request, token event or unusual source location precede a successful action?
- Was a service account acting under an approved automation, or did a human unexpectedly use it?
4. Correlate endpoint evidence
For every implicated device, query the deployed endpoint platform’s process, logon, file, network and response-action telemetry over the same time window. Join on stable user and device identifiers, then validate each field against the platform’s current schema.
There is no universal endpoint table name or guaranteed event set across vendors. Do not publish or reuse a query written for another platform without checking the local schema, collection policy, sensor version and retention. At minimum, look for:
- Interactive and remote logons, token or session creation and account changes.
- Browser or desktop host processes that launched the AI experience.
- Child processes, scripts, shells and unsigned or newly created binaries.
- Files read, written, archived or uploaded near the interaction time.
- Outbound connections, destination domains, IP addresses and unusual ports.
- Endpoint isolation, kill, quarantine or other automated response actions.
Correlate device evidence with the cloud identity rather than assuming the endpoint that raised an alert is the source of every action. A cloud action may have originated from another device, a browser session or an automation host.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
5. Use investigation and SIEM tools as pivots
AWS CloudWatch investigations
A CloudWatch investigation can analyze telemetry such as CloudTrail change events and CloudWatch Logs Insights queries. Every action taken by a CloudWatch investigation is logged in CloudTrail, so inspect those records alongside the investigation output. If investigators add data sources, share results or execute suggested runbook remediations, record who had permission, what changed and when.
CloudWatch investigation output is AI-generated observations, suggestions and hypotheses. Treat it as a lead, not as evidence. Re-run the underlying CloudTrail or Logs Insights queries and preserve the source events that support or contradict each conclusion.
Permissions and background activity
CloudWatch investigations can use the signed-in user’s permissions. Configured investigation groups may periodically scan resources to map topology, and some services can invoke KMS decrypt API calls on CloudWatch’s behalf for describe or list operations. Understand the configured permissions and resulting events before labeling those calls malicious or user initiated.
6. Decide when content review is necessary
Metadata can establish that a user interacted with an assistant and which resources were referenced. It may not reveal the actual prompt, response or stored memory. If the case turns on what the user asked, what the assistant disclosed or whether sensitive text was pasted, escalate to an authorized content-review surface.
Microsoft’s incident-response guidance describes Unified Audit Log events as “metadata-first.” Purview eDiscovery or DSPM for AI may provide prompt/response or memory insights when the required product setup, roles, licensing, retention and collection are in place. Confirm internal legal, privacy and authorization requirements before collecting or reading content, and document the scope of the review.
Use metadata first when it answers the question
- Use audit metadata to establish identity, time, host and referenced resources.
- Use cloud and endpoint records to test whether a consequential action followed.
- Request content only when metadata cannot resolve the allegation or competing explanations.
- Limit content collection to the approved time, users, cases and repositories.
7. Test competing explanations
Do not treat an unusual AI event as proof of misuse. Compare it with the user’s duties, approved tool access, maintenance or change windows, known automation and ordinary endpoint and cloud behavior.
Evidence that increases concern
- An identity or device outside its normal geography, schedule or resource scope.
- Privilege, key, policy or deployment changes closely following the interaction.
- Data reads or downloads inconsistent with the user’s role.
- Repeated policy denials followed by a successful path using another identity.
- Unexpected scripts, archives, browser extensions or outbound connections on the endpoint.
- An AI-generated remediation that was actually executed without a matching change ticket.
Evidence that supports an expected explanation
- A documented incident, maintenance window or approved runbook matches the time and resources.
- The same identity and device routinely perform the operation.
- Automation records explain the service-account activity and its scope.
- Endpoint and cloud telemetry show no linked access, file or configuration change.
Keep observed facts separate from generated interpretations. An assistant’s suggested attack path is a hypothesis until original telemetry confirms it.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute8. Build a timeline that survives review
Normalize every source to a stated time standard, preferably UTC, while retaining the original timestamp and time-zone information. A one-minute difference caused by display conversion can make a legitimate automation job appear to precede the user action, or hide the order of a denial and a successful request.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
- Anchor the interaction: Start with the AI audit record and note its event type, identity, host and resource references.
- Look backward: Check sign-ins, token issuance, role changes, group changes, browser sessions and endpoint logons that could explain how the interaction began.
- Look forward: Search for reads, writes, downloads, deployments, key listing, policy changes, network connections and response actions.
- Mark causality carefully: Label records as directly observed, temporally associated or merely suggested by an automated analysis.
- Preserve the join keys: Keep account, device, subscription, project, region, case and resource identifiers exactly as exported so another analyst can reproduce the joins.
Do not infer that a referenced resource was opened merely because it appears in AI metadata. Confirm access in the applicable cloud Data Access or endpoint records, and state when that confirmation is impossible.
9. Handle delegated identities and automation explicitly
AI tools often operate across a human session, a host application and a service identity. Record all three when available. A service account event without the initiating user may reflect approved automation; a human sign-in followed by service-account activity may indicate delegation; either way, the account’s permissions and normal schedule matter.
Compare the observed scope with the automation’s documented purpose. Check whether a role, key, group membership or workload identity changed shortly before the event. In AWS, also account for the signed-in user’s permissions and CloudWatch investigation activity that may generate background topology scans or service-side KMS decrypt calls. In Google Cloud, separate user-driven Admin Activity from System Event records so platform changes are not misattributed to the operator.
Free tools Windows power users keep installed
One-click scans. No signup required.
10. Plan for retention, enablement and cost
Evidence availability is an engineering property, not just an analyst skill. Record which logs were enabled when the event occurred, where they were routed, whether exclusions applied and how long they were retained. A log that is enabled today may not contain last month’s activity if retention began later.
- Microsoft: The documented 180-day period applies to specified pay-as-you-go audit logs for non-Microsoft AI applications. It does not establish retention for Microsoft applications, every tenant or every AI product.
- Google Cloud: Admin Activity and System Event records are written by default, while Data Access is disabled for most services except BigQuery. Turning on Data Access can increase log-usage charges. Policy Denied records are generated by default but may be removed by exclusions.
- AWS: Review CloudTrail coverage for CloudWatch investigation actions, data sources and runbook remediations. Treat any configured background scans and resulting service calls as part of the activity record.
- Endpoint platforms: Sensor version, collection policy, storage tier and retention determine whether process, file or network details can still be joined to the cloud timeline.
When estimating cost, distinguish collection from storage and querying. Enabling more detailed data-access or endpoint telemetry may improve coverage while increasing ingestion, storage or query usage. State the expected operational trade-off and obtain approval through the normal logging-change process.
11. Apply privacy and authorization controls
Prompt and response text can contain personal, confidential or regulated information. A content review should have a defined purpose, authorized reviewers, bounded users and time range, and an approved repository. Start with metadata and expand only when the allegation cannot be resolved without content.
Record which role authorized the collection, which product surface was used, what retention applied and whether the material was copied into the case. Avoid placing sensitive prompt text in broad incident channels when a restricted evidence location is available. If content is unavailable because the feature was not enabled, say so directly rather than attempting to reconstruct it from an AI-generated summary.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →12. Document gaps, scope and conclusions
End the case with a reproducible scope statement. List the time range, accounts, projects or tenants, devices, queries and filters examined; the permissions used; each data source and its collection status; retention boundaries; and records that were unavailable.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Explain whether a missing event means the action was not observed, the service did not emit that event, logging was disabled, an exclusion blocked storage, a sink omitted it, retention expired or permissions prevented access. Those explanations have different investigative weight.
Suggested conclusion format
- Established: State the identity, interaction time, host and resource references directly supported by records.
- Correlated: List matching sign-ins, cloud operations, endpoint events and any response actions.
- Contradicted or unresolved: Identify competing explanations and evidence that could not be obtained.
- Content status: State whether prompt or response content was reviewed, not available or outside the approved scope.
- Confidence and next action: Describe the remaining uncertainty and the authorized containment, monitoring or collection step.
Evidence-source comparison
| Evidence layer | Typical answer | Prerequisites and limits |
|---|---|---|
| AI audit metadata | Who interacted, when, through which app or host and which resources were referenced. | Fields vary by product and audit surface; content may be absent. |
| Prompt, response or memory content | What was asked, disclosed or retained. | Requires a separate enabled surface, permissions, retention and authorization. |
| Cloud control-plane logs | Configuration, IAM, deployment and metadata changes. | Service schemas, regions and retention differ. |
| Cloud data-access logs | Reads and operations on resource data. | Coverage may be disabled by default and can increase log charges. |
| Endpoint telemetry | Processes, logons, files, networks and response actions. | Collection and table names depend on the deployed platform and sensor configuration. |
| Investigation assistant output | Suggested observations, pivots and hypotheses. | Generated output is not a substitute for original events; assistant actions themselves need auditing. |
Common failure modes and fixes
Searching for one universal “AI misuse” event
Fix: Identify the exact assistant and host, then pivot through identity, cloud and endpoint sources.
Assuming an audit event contains the prompt
Fix: Treat the event as metadata unless the product explicitly exposes content, and use an authorized content-review workflow when necessary.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Interpreting absent Google Cloud Data Access records as no reads
Fix: Verify service-level enablement, exclusions, sinks and retention; remember that most Data Access logs are disabled by default.
Accepting an AI-generated investigation narrative
Fix: Validate every observation and remediation against CloudTrail, CloudWatch Logs Insights, identity records and change management.
Reusing endpoint queries without schema validation
Fix: Check the current platform schema, sensor version, collection policy and local field availability before drawing conclusions.
Confusing a reference with a confirmed access
Fix: Treat a resource listed in AI metadata as a lead. Confirm a read, write, download or configuration change in the corresponding cloud or endpoint telemetry.
Failing to audit the investigator’s own actions
Fix: Record added data sources, shared results, executed runbooks and permission use. AWS CloudWatch investigation actions are logged in CloudTrail, so include those events in the case timeline.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Expanding content collection too early
Fix: Use the least intrusive evidence layer that answers the question, then obtain the required role, retention and internal authorization before reviewing prompts, responses or memory.
Frequently Asked Questions
Which log shows exactly what a user asked an AI security assistant?
Often none of the ordinary audit records. AI audit events are generally metadata-first: they may identify the user, time, host and referenced resources without storing prompt or response text. Use an authorized Purview eDiscovery or DSPM for AI workflow when the product is configured to retain that content.
Does an AI audit event prove that a referenced cloud resource was read?
No. A resource reference establishes that the assistant’s activity included that object, not necessarily that data was retrieved. Confirm the action with cloud Data Access records, endpoint file or network telemetry, or state that the available evidence cannot prove access.
Recommended Free Tools
Are Google Cloud Data Access logs always available?
No. They are disabled by default for most services except BigQuery. Enablement, exclusions, routing and retention must be checked for the affected service, and enabling them can create additional log-usage charges.
Can AWS CloudWatch investigation output be used as the finding?
Use it as a pivot or hypothesis. AWS describes the output as AI-generated observations, suggestions and hypotheses. Validate each claim against CloudTrail, CloudWatch Logs Insights, identity records and change-management evidence. Also review CloudTrail records for actions taken by the investigation itself.
What if the endpoint has no process or network event for the time in question?
Do not conclude that no endpoint activity occurred. Check the sensor version, collection policy, device identity, time conversion, routing and retention. The cloud action may also have originated from another device, browser session or automation host.
How long are Microsoft audit records retained for AI activity?
Microsoft documents 180 days for specified pay-as-you-go audit logs covering non-Microsoft AI applications. This figure is not a universal retention period for Microsoft apps, every tenant or every AI service; verify the applicable audit model and licensing.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How should a service-account interaction be investigated?
Identify the workload, delegated human session and service identity when available. Compare the scope and timing with approved automation, then check role, key or group changes, sign-ins and downstream cloud and endpoint actions. Do not assume either benign automation or human misuse without those correlations.
When should an investigator review prompt or response content?
Only when metadata and surrounding telemetry cannot resolve the allegation, such as whether sensitive text was pasted or a response disclosed protected information. Confirm product setup, permissions, retention, legal or privacy authorization and a narrowly defined collection scope first.
The Bottom Line
A defensible investigation links an AI interaction to identity, cloud and endpoint evidence without overstating what any single record proves. Preserve first, identify the exact assistant and host, verify referenced resources and downstream actions, audit investigator-generated activity, and document retention, cost, permissions and gaps. Escalate to prompt or response content only when the approved metadata and telemetry cannot answer the question.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
