Monitoring and Incident Response

Analyze these application logs for security concerns:

[Paste relevant log entries]

Context:
- Application: REST API (FastAPI)
- Normal traffic: 1,000 requests/hour
- Authentication: JWT tokens
- Infrastructure: Kubernetes on AWS

Look for:
1. Authentication anomalies (brute force, credential stuffing)
2. Authorization violations (accessing resources without permission)
3. Injection attempts (SQL, XSS, command injection in parameters)
4. Data exfiltration patterns (unusually large responses, bulk queries)
5. Infrastructure probing (scanning, enumeration attempts)

For each finding:
- What was detected and the specific log entries
- Severity assessment
- Recommended immediate action
- Recommended investigation steps

I have logs from three services during a suspicious event
window (14:00-14:30 UTC):

API Gateway logs: [paste sample]
Auth Service logs: [paste sample]
Database audit logs: [paste sample]

Correlate events across these services:
1. Build a timeline of what happened
2. Identify the initial entry point
3. Trace the attack path across services
4. Determine what data may have been accessed
5. Identify the point where detection should have triggered

Generate an incident response playbook for:

Incident type: Suspected data breach via exposed API endpoint
Environment: Production Kubernetes cluster (AWS EKS)
Data sensitivity: PII (names, emails, phone numbers)

Playbook sections:
1. DETECTION — What triggered this playbook? What alerts/signals?
2. TRIAGE (first 15 minutes)
   - Severity classification criteria
   - Initial containment actions
   - Who to notify (on-call, security lead, management)
3. CONTAINMENT (15-60 minutes)
   - Network isolation steps
   - Credential rotation procedures
   - Evidence preservation
4. INVESTIGATION (1-4 hours)
   - Log analysis checklist
   - Scope determination
   - Data impact assessment
5. REMEDIATION
   - Root cause fix
   - Security control improvements
   - Monitoring enhancements
6. RECOVERY
   - Service restoration steps
   - Verification checks
7. POST-INCIDENT
   - Postmortem template
   - Regulatory notification requirements (GDPR, CCPA)
   - Customer communication draft

Include specific AWS CLI commands and kubectl commands
for each step.

Design automated incident response rules for our environment:

Trigger conditions and automatic actions:

1. Brute force detected (>100 failed auths in 5 min from one IP)
   → Auto: Rate limit IP, alert on-call
2. Suspicious API pattern (>10 requests to /admin from non-admin user)
   → Auto: Block session, alert security team
3. Data exfiltration pattern (response body >10MB in bulk queries)
   → Auto: Log detailed request info, alert on-call
4. Container escape attempt (unexpected process in container)
   → Auto: Kill pod, preserve logs, alert security team

For each rule, generate:
- Detection logic (Prometheus/alerting rule or SIEM query)
- Automated response action
- Escalation criteria (when does auto-response trigger human review?)

Generate an incident postmortem report:

Incident: Unauthorized access to customer database
Date: [date]
Duration: Detected at 14:15 UTC, contained at 14:45 UTC
Impact: ~500 customer records potentially accessed

Timeline:
[paste chronological events]

Generate a blameless postmortem with:
1. Executive summary (3 sentences)
2. Timeline of events
3. Root cause analysis (Five Whys)
4. Contributing factors
5. What went well (detection and response positives)
6. What needs improvement
7. Action items with owners and deadlines