---
name: observability-and-incident-response
description: Review security logging, alerting, audit trails, containment, recovery, and post-incident evidence.
---

# Observability and Incident Response

Check whether security-relevant events are logged with actor, target, result, request ID, and timestamp without exposing secrets or personal data. Review alert thresholds, retention, tamper resistance, access, key rotation, containment, rollback, recovery, and post-incident learning.