Mission 11 · Practice the response
A knock at a forbidden door
Notice a signal worth investigating.
The bot usually uses only its permitted services. Today the proxy records an attempt to reach pastebin.com, a destination not allowed by this design.
Proxy audit log · simplified
“Request rejected: destination not allowed — pastebin.com”
The decision
How should the operator respond?
- Ignore it because the request was blocked
A stopped attempt cannot teach us anything. - Investigate promptly and check related activity
A rejection can reveal a misled bot, a compromise, or a configuration problem. - Add the website to the allowlist immediately
Making the warning disappear is the goal.
Reveal the explanation
The wall working is good news; the unexpected attempt still matters. Investigate before relaxing the boundary.
A rejection is evidence, not a reason to automatically open the door.- The guide monitors proxy rejections, network drops, changed configuration files, and unexpected host logins.
- Any unexpected egress from the execution sandbox is especially concerning because it should have no allowed external destination.
- Logs can contain sensitive metadata. Protect them, and remember the server operator can see more than a normal bot user.
Audit log
A record of actions and decisions that helps an operator understand what happened.