Uber Cybersecurity Incident: Which Logs Do IR Teams Need to Focus On?

On September 16 Uber disclosed a major compromise where an attacker leveraged phishing to obtain admin credentials and pivoted across multiple services (Thycotic PAM, AWS, Google Workspace, HackerOne, Slack). The report enumerates the relevant audit and activity logs investigators should collect from each platform (Thycotic audit reports, AWS CloudTrail, Google Reports API, HackerOne and Slack audit logs) to trace actions, detect anomalous privileged behavior, and recommends a holistic breach readiness approach including forensic data lakes and SaaS/cloud-focused IR partnerships.