What attacks and incidents leave behind in your logs, and how to investigate them with the logs you already have.
Investigate a suspected account takeover from your logs: scope sessions and IPs, build the timeline, contain, check what was accessed, and notify.
A new CVE is public. Decide if it is worth a hunt, set the log window, search with zgrep and jq, and separate failed attempts from real compromise.
Read CloudTrail events, pivot from a key, user, or IP, and run Logs Insights and Athena queries for failed logins, new keys, StopLogging, and secret reads.
An npm package you use was backdoored. Check lockfiles, CI logs, and dev machines, see if install scripts ran, rotate exposed secrets, and rebuild clean.
Find failed SSH login attempts in auth.log or journald, count them by IP, spot a success after failures, and harden sshd with key-only auth and fail2ban.
How the GitHub audit log works: search qualifiers, REST API, streaming, 180-day retention, and queries for repo visibility, deploy keys, and role changes.
What a web shell leaves in access logs, on disk, and in the process tree, with commands to find one, and how to respond once you have.
Turn on Kubernetes audit logs on EKS, GKE, or a self-managed cluster, then use jq to find pod exec, secret reads, RBAC changes, and anonymous requests.
A GitHub, Stripe, or OpenAI key was exposed. Revoke it, find where it leaked in git, CI, and client bundles, and check the provider audit log for misuse.
An AWS access key leaked. Deactivate it, see what it did in CloudTrail by AccessKeyId, read GuardDuty findings, and rotate without breaking production.
PCI DSS Requirement 10 for logging: what 10.2 must capture, how to protect and review logs, the 12-month retention rule, time sync, and control failures.
Credentials and personal data end up in logs more often than teams expect. Search for them with regexes, rotate before you purge, and redact at the logger.
What to log for security: auth events, access control failures, admin actions, and high-value transactions, with fields, exclusions, integrity and alerts.