Monitoring, Detection & Incident Response

31 items · source

Filter items

Monitoring / Detection

Monitor authentication anomalies.
Monitor repeated authorization failures.
Monitor privilege changes.
Monitor API-key creation.
Monitor API-key rotation.
Monitor MFA changes.
Monitor password-reset spikes.
Monitor signup spikes.
Monitor unusual exports.
Monitor large downloads.
Monitor storage enumeration.
Monitor webhook abuse.
Monitor IAM changes.
Monitor GitHub workflow changes.
Monitor production branch changes.
Monitor unexpected origin requests.
Monitor secrets-access anomalies.
Alert on direct-origin traffic where it should not occur.
Verify the process handles unhandled promise rejections and uncaught exceptions by logging the error's class and a fixed description, never the raw error object — a database or cache client's error can carry the command it was running, password included.

Incident Response

Document how to rotate JWT signing secrets.
Document how to rotate database credentials.
Document how to rotate GitHub credentials.
Document how to rotate Google service credentials.
Document how to revoke Apple signing credentials.
Document how to revoke active sessions.
Document how to disable compromised accounts.
Document emergency DNS rollback.
Document emergency deployment freeze.
Document compromised-container response.
Document stolen mobile credential response.
Test the incident-response procedures.

# Monitoring, Detection & Incident Response

## Monitoring / Detection

* [ ] Monitor authentication anomalies.
* [ ] Monitor repeated authorization failures.
* [ ] Monitor privilege changes.
* [ ] Monitor API-key creation.
* [ ] Monitor API-key rotation.
* [ ] Monitor MFA changes.
* [ ] Monitor password-reset spikes.
* [ ] Monitor signup spikes.
* [ ] Monitor unusual exports.
* [ ] Monitor large downloads.
* [ ] Monitor storage enumeration.
* [ ] Monitor webhook abuse.
* [ ] Monitor IAM changes.
* [ ] Monitor GitHub workflow changes.
* [ ] Monitor production branch changes.
* [ ] Monitor unexpected origin requests.
* [ ] Monitor secrets-access anomalies.
* [ ] Alert on direct-origin traffic where it should not occur.
* [ ] Verify the process handles unhandled promise rejections and uncaught exceptions by logging the error's class and a fixed description, never the raw error object — a database or cache client's error can carry the command it was running, password included.

## Incident Response

* [ ] Document how to rotate JWT signing secrets.
* [ ] Document how to rotate database credentials.
* [ ] Document how to rotate GitHub credentials.
* [ ] Document how to rotate Google service credentials.
* [ ] Document how to revoke Apple signing credentials.
* [ ] Document how to revoke active sessions.
* [ ] Document how to disable compromised accounts.
* [ ] Document emergency DNS rollback.
* [ ] Document emergency deployment freeze.
* [ ] Document compromised-container response.
* [ ] Document stolen mobile credential response.
* [ ] Test the incident-response procedures.


31 items · https://github.com/FarzamHabibi/pre-production-checklist · CC BY 4.0