Asep Sayyad

The edge HIT ratio was the key factor in reducing the load. Once public pages started serving from the cache, the origin had much less work to do. I kept dynamic /api routes uncached, since they still needed to reach the origin. If the origin had remained under pressure, temporarily rate-limiting nonessential API requests would have been my next step. Great point about cache purging across PoPs!

Thanks for such a detailed read! The distinction between terminal input and keyboard scan codes is an important detail, and the explanation of how nss-mdns interacts with DNS makes the resolver section even more interesting. Glad you also found the HTTP-to-HTTPS redirect walkthrough accurate. Really appreciate you sharing these insights!

That's a good point. Country alone shouldn't be treated as proof of a suspicious login. Checking the IP's ASN and organization first can help separate a real anomaly from a VPN or cloud network. I'll definitely consider adding this to the initial triage steps. Thanks!

Great point. I focused mainly on host-level persistence in this playbook, but cloud credentials are an important part of the investigation too. Checking the instance metadata access and CloudTrail/GuardDuty activity should definitely be added for EC2 cases. Thanks for pointing this out!