Forensic web services record transactions — whenever they are invoked — between pairs of services, and piece them together into pictures of the complex transactional scenarios that occurred during specific time periods, such as during an attack.