Estonian web blue team has evolved Locked Shield defence and threat hunting toolkit over past 4 years and a lot of it could - and should - be used also in real life. We'll run through the scenario of dockerising whatever webapps, secure configurations, WAF tricks and easy ways to make your logs usable. All templates - sidecar containers, configurations, etc - will be public, docker-savvy participants can follow our scenario on their own computers and the rest gets chance to interact with sample application and navigate through the resulting logs in real time.