For many IT organizations, triaging or troubleshooting starts with assessing symptoms. As practitioners investigate the causal factors by answering each of the “5 whys,” logs are often where the actual root cause answers lie. This is even more true for issues related to configuration changes, change management, and security. However, diving into log data can be overwhelming as a first step due to the high volume and velocity of logs and missing context.

Elastic Observability is the premiere tool to provide visibility into web apps running in your environment. AWS App Runner is the serverless platform of choice to run your web apps that need to scale up and down massively to meet demand or minimize costs. Elastic Observability combined with AWS App Runner is the perfect solution for developers to deploy web apps that are auto-scaled with fully observable operations, in a way that’s straightforward to implement and manage.

In today’s world of relentless data growth, security-relevant logs represent a small snapshot of an organization’s overall environment. Teams are beset with a variety of data types, including performance metrics and traces, asset configuration and state, audit logs, and much more. On top of that, teams are expected to scan all of this to compare against industry best practices and join this data with logs and metrics for added context.

In Part 1 of this series, we talked about some challenges with building sufficient coverage for detecting security threats. We also discussed how telemetry sources like logs are invaluable for detecting potential threats to your environment because they provide crucial details about who is accessing service resources, why they are accessing them, and whether any changes have been made.

The most popular check that Oh Dear offers is, without a doubt, our uptime check. It's enabled for almost every site we monitor. By default, this check will notify you when your site returns a non-2xx response, but you can greatly customize that behavior. You can check if the response has certain headers, if the response contains a particular string, and more! Some of our users requested a new behavior: checking the absence of a string on the response.