Log aggregation collects log records from application and infrastructure sources, then routes them to centralized storage for searching and security analysis. section 11.5
A practical pipeline writes logs to stdout, treats them as streams, and uses a router such as Logplex or Fluentd to deliver them to an aggregator. Container deployments can run the collector beside the application as a sidecar. section 11.5
Use the collected records to:
- Investigate requests associated with malicious injection attempts, optionally annotating records to identify the attack. section 11.5
- Remember that logs alone may miss attacks spread across many requests. section 11.5
