Logs – Tessera

AWS CloudTrail Export

AWS CloudTrail events exported for the period 20-02-2025 to 27-02-2025 (breach window for TSR-INC-2025-031). Principals and account identifiers have been redacted. Events…

Application Server Logs

Application Server

These logs include suspicious activities on the application server.

Database Access Logs

These logs capture the sequence of database queries and export actions taken by the attacker.

Endpoint Detection and Response (EDR) Logs

Endpoint Detection and Response (EDR)

These logs indicate endpoint-level alerts and actions.

Firewall Logs

These logs show external connections and potential unauthorised access attempts.

IAM Credential Revocation Log

IAM credential last-used and access-key last-rotated data extracted from AWS IAM (get-credential-report / get-access-key-last-used) as part of the access-revocation test for…

SSO / IdP Session Log

Identity provider (Auth0) authentication and session events for selected identities, extracted for the access-revocation test (ISO/IEC 27001:2022 A.6.5) and the breach…

Security Information and Event Management (SIEM) Alerts

Security Information and Event Management (SIEM)

These logs detail alerts triggered by the SIEM system.

VPN Access Logs

These logs show the initial access via the VPN using compromised credentials.