This is where correlation would have to occur. You see your son/daughter upset at 5:30 PM. Suppose logs show your son/daughter was accessing IPs associated wi

This is where correlation would have to occur. You see your son/daughter upset at 5:30 PM. Suppose logs show your son/daughter was accessing IPs associated with Facebook/Messenger at 5:28 PM. One could reasonably infer that something/someone upset them.