You do not change anything. You only look, scroll, and note the timing of alerts moving through the queues, how long they sit, who touches them, what language appears when nothing is “wrong” yet. Your eyes start to learn a rhythm that is not written in any manual: the difference between a system that is busy and a system that is being managed. For once, restraint feels like competence rather than fear, because you are not trying to steal a secret in one heroic click. You are trying to understand a habit. You take screenshots you may never use. You write timestamps you may never show anyone. You feel the strange calm of doing harm’s reconnaissance without doing harm yet, and the calm is its own warning. [[Audit Log Footprints|Check the audit log footprints]]