Field note
Logging for humans who are already under pressure
Volume is not visibility. During an incident, engineers need a short path from alert to the identity, change, or network edge that matters. Softgategrid field notes from London engagements keep returning to the same failure: logs exist, but correlation keys do not.
Prefer stable request identifiers, actor identifiers, and deployment versions on every security-relevant event. Then practice finding a fabricated compromise using only those fields.
If your stack cannot answer “who changed this trust rule in the last hour?” within minutes, the gap belongs on the remediation map ahead of cosmetic dashboard work.
We treat logging design as part of secure architecture review, not a separate observability hobby project.