[bluGill]

My guess is it was the only obvious evidence of an attack.

[red-iron-pine]

Gill probaby already knows this but for the uninitiated: something logged in, did a thing to potentially every container, and then deleted any sign of it doing the thing.

all that's left is a single timestamp of a log or something getting deleted