Who read the password hashes?
A file-integrity alert says /etc/shadow was read at night on app-01. Use auth.log to find the account, the time, and where that session came from.
Briefing
The file-integrity monitor on app-01 raised an access alert for /etc/shadow at 02:14. Nobody on the operations rota was on call.
Every sudo command is logged to /var/log/auth.log with the account, the working directory, and the full command line. Start there.
app-01 · Linux log triage
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.