Ravi Sir's Cyber Security Cards › Interview Cards
Why are immutable logs important?
Why are immutable logs important? Attackers delete local logs to hide. Immutable (write-once) logs keep the evidence safe. Shipping logs to a locked SIEM or a locked S3 bucket means the attacker can’t erase them. “CloudTrail to a locked bucket is the AWS version of keeping evidence safe.” If logs ca
Read card text
What this card says
Short answer
Attackers delete local logs to hide. Immutable (write-once) logs keep the evidence safe.
Example
Shipping logs to a locked SIEM or a locked S3 bucket means the attacker can’t erase them.
Say it in the interview
“CloudTrail to a locked bucket is the AWS version of keeping evidence safe.”
Why it matters
If logs can be deleted, you may never learn what the attacker did.
Learn more in the lesson: 46.8 SOC, IR, Hardening and Cryptography Questions