FIELD NOTE · E5 · Com2us Platform · Feb 2023 – Feb 2026
From a monthly security review to a daily automatic one
Catching risky actions across four clouds on the day they happen
Monthly → Daily · 4 Clouds
- Problem
-
Security reviews happened once a month and took days of manual work. If someone gave themselves excessive permissions or deleted a key server, we might not know for nearly a month. No one asked me to fix it. I decided to change it myself.
- Judgment
-
Even a simple permission change was recorded differently in every cloud. I chose to convert every log to one common standard, "who did what, to which resource, and when".
- What I did
-
Audit logs from every project in all four clouds are collected, normalized, and reviewed automatically before dawn each day. Only actions that could lead to an incident count as critical. They go to Telegram and Slack, and are recorded as resolved after the actor confirms.
- Result
-
The review cycle went from monthly to daily, and awareness of risky actions went from up to a month later to the same day. No one had to set time aside for it anymore; the review was already done automatically at the same time every day.
- What I learned
-
Defining the signals that lead to incidents, and never missing them, matters more than analysis after the fact. Without authority, "I tried this and it got better" persuades more than "we should do this".