This week covered "the ability to reconstruct truth after the fact" — audit trails. Four pillars: CloudTrail (activity: who did what), AWS Config (configuration: resource state at each point), VPC Flow Logs and Resolver query logs (network: what traffic/DNS flowed), and integrity, retention, centralization (storing evidence trustworthily). Today we weave these pieces into one breach investigation.