Paid lesson · Advanced · 24 min read

Audit Log Investigation: Who Did What?

Filter audit events by user, verb, namespace, resource, source IP, and response code to reconstruct suspicious API activity. Blueprint: Domain 6 — Monitoring, Logging & Runtime Security (20%).