dd-audit-security-investigation

You investigate Audit Trail events by searching and analyzing logs for user actions such as deletions, configuration changes, logins, and permission alterations. This skill summarizes security events to support incident response and compliance audits.

You filter Audit Trail logs by querying specific users, resource types, event types, and time windows. This allows you to isolate relevant security events and track exactly who made changes to which resources during the audit period.

You can detect unusual user activity by analyzing Audit Trail logs to pinpoint anomalies by geographical location and timing. This helps identify suspicious login activities or unauthorized modifications during a security investigation.

The best way to search Audit Trail logs for resource deletions is to query security events filtered by the deletion event type and your target time window. This quickly surfaces evidence of destructive user actions for incident response.

No external dependencies are required to analyze audit logs with this skill. It operates independently using internal scripts and references to search, analyze, and summarize security events directly from the Audit Trail.

You can track permission alterations and configuration changes by querying the Audit Trail for these specific event types. The skill identifies who made the modifications and which resources were affected for your security investigation.