One red flag that stood out for me is where the blog says the team considered all apps to be the same and hadn’t looked at any of their logs, only infrastructure stuff.

When they looked they saw all apps were not the same, and it was only a few kinds of apps that were affected.

When a big incident hits, you need people drilling down not just across; and hopefully people who know the actual apps in question.

Maybe this was DevOps people too far into the ops side and not as much on the dev?