Technical Guide “Please Produce the Logs from Three Years Ago” — Four Ways to Survive an Audit by Design
Two weeks to produce them. You retained them, yes. But how many days does it take to get them back out? Retent…
Audit
Technical Guide 
Technical Guide Logs as Evidence — Four Principles for Preserving, Excerpting, and Proving Integrity
The reboot cost thirty-eight minutes of log. Fixing it was right. What should you have taken with you first? L…
Technical Guide The Traces Are in the Raw Log — Four Views on Lateral Movement, SQLi, and After-the-Fact Investigation
The encryption took eleven minutes. What matters is the six days before it. Which log do you read first, and i…
Technical Guide The First Hours of an Intrusion Investigation — Four Steps Through Tens of Millions of Auth Log Lines
4,812 failures. One success. All from the same IP. It could be an attack, or someone who forgot their password…