Technical Guide Log Investigation Lives in One Person’s Head — Four Habits of a Team That Can Hand It Over
The handover note was three lines long. The query you built yesterday — could anyone else rebuild it right now…
Incident Response
Technical Guide 
Technical Guide Logs as Evidence — Four Principles for Preserving, Excerpting, and Proving Integrity
The reboot cost thirty-eight minutes of log. Fixing it was right. What should you have taken with you first? L…
Technical Guide The Traces Are in the Raw Log — Four Views on Lateral Movement, SQLi, and After-the-Fact Investigation
The encryption took eleven minutes. What matters is the six days before it. Which log do you read first, and i…
Technical Guide Making the On-Call Night Lighter — Four Things You Set Up for Your 2 A.M. Self
2:14 a.m. Ninth reopen. The same 50 GB log, opened nine times tonight already. Why does investigation turn int…
Technical Guide Chasing an Outage by the Clock — Four Ways to Use Timestamps as Evidence
All you have is 14:07. That's the whole report. No error message, no request ID, no reproduction steps. A few…
Technical Guide The First Hours of an Intrusion Investigation — Four Steps Through Tens of Millions of Auth Log Lines
4,812 failures. One success. All from the same IP. It could be an attack, or someone who forgot their password…