Every log must fire: applying Chekhov's gun to cybersecurity incident reports(andreafortuna.org)

Every log must fire: applying Chekhov's gun to cybersecurity incident reports

https://andreafortuna.org/2025/11/17/chekhovs-gun-and-cybersecurity-incident-reports

3 comments

I agree with the premise that report writers usually lack an ability to tell the story. It's tough though because I know a lot of SOCs and IT dept's will take any detail they can get if an incident happens in their own vertical and there is a lot of desire to help the community in IT/security culture.. but these reports really are for business partners more than anyone else and in that context, people could learn a lot by taking the advice into account.

The post does use cyber industry terminology inconsistently though, noted in another comment, and I fear that's going to make every technologist exit the page before getting the point.

johnnyo8 ay önce

I wish the same rule applied to their site design. It’s 90% ads on mobile, almost completely unreadable.

marcosdumay8 ay önce

WTF? Now I wish to vote down a submission just because of the clickbait title.

Logs, alerts, and indicators are all different things with completely different barriers to existence. Stop fucking up the language by purposefully confounding them.

No, the entire reason logs exist is because you want to save things that do not trigger some action by themselves, or maybe even rarely be used for something.