someone got into my server, suspicious activity in logs — what to do immediately?

You're right, I've been down that road too. Hasty decisions become decisions you have to fix six months later.

When making decisions, write down the worst-case scenario too, not just the best. Correct me if I'm wrong.

Let me summarize the topic, since several different answers were given. Everything goes well for the first three months; problems arise in the fourth.

i didn't know that. tbh if permission and scope aren't in writing, don't start that test.

if the notification path is long notifications don't arrive; missing notifications mean delayed incident detection but i'm also curious if anoyne does it differently.

Timely topic. If you scold false alarms nobody will report again.

If you have questions write them; I'll answer as best I can.

Three different views emerged they all complement each other. If it's your first time start small; scaling comes later.

Taking notes for two weeks yields better results than a six-month estimate. If you have questions, write them; I'll answer as best I can.

Thanks, this was very helpful... If you scold false alarms, nobody will report again.

Most time waste accumulates in tasks waiting for approval. btw that's all sorry if I went on too long.

We need to make a distinction here. Your time to detect an issue directly determines its cost.

Of course, it varies if your situation is different.

Exactly, and not many people know this. When making decisions, write down the worst-case scenario too, not just the best.

Correct me if I'm wrong.

I went through the same thing two years ago. Security isn't absolute; it's about making attacks not worth the effort.

Taking notes for two weeks yields better results than a six-month estimate. Correct me if I'm wrong.

I went through the same thing.

Yes, that's exactly how it is with server compromised what to do. Solutions that work at a small scale collapse when you grow; I learned this late.

Start with a small trial; don't commit to everything at once.

Absolutely. If I were to add anything: Solutions that work at a small scale collapse when you grow; I learned this late.

Most time waste accumulates in tasks waiting for approval. honestly just leaving this note, it might be useful.

Great work. Taking notes for two weeks yields better results than a six-month estimate.

Security isn't absolute; it's about making attacks not worth the effort.

There's a part I don't understand. Everything goes well for the first three months; problems arise in the fourth.

great work but most time waste accumulates in tasks waiting for approval.

Let me share my experience. Don't hesitate to ask; those who don't ask always pay more.

There is something to watch out for. Your time to detect an issue directly determines its cost.

When you try to change everything at once, nothing settles. If I were you, I'd go this route.

I went through the same thing two years ago. Your time to detect an issue directly determines its cost.