Challenge: investigate an incident from logs alone

The previous three lessons covered what to log, how to return errors, and how to alert. This one tests the only thing that proves all three worked: whether you can use those logs to investigate a real incident.

And it tests something harder: noticing which field is missing. In a real investigation the most valuable thing you learn is not the answer but the list of questions you could not answer — because that is the list of fields to add before the next incident.

The situation — 08:10 on a Thursday. An enterprise customer files a ticket:

"Our activity history shows that three of our company's contracts were viewed by an account that does not belong to our company. What is going on?"

You have: 30 days of application logs, a year of security_event, and a load balancer access log.

What to produce.

1. Reconstruct the chain: how did the attacker get in, what did they do, what did they read?
2. Establish the scope: only those three contracts, or more?
3. State the question you cannot answer from the logs you have, and which field is missing.
4. Is there a duty to notify other customers?

Questions 2 and 3 are what count, and they are related: usually you cannot establish scope precisely because a field is missing.