logging-monitoring

name	logging-monitoring
description	Use when designing security logging, monitoring, and incident detection capabilities. Covers SIEM architecture, audit trail requirements, security event correlation, and compliance logging for GDPR, PCI DSS, HIPAA, and SOX. USE FOR: SIEM, security logging, audit trails, security monitoring, incident detection, log aggregation, security event correlation, compliance logging, intrusion detection DO NOT USE FOR: application performance monitoring (use observability skills), general logging frameworks (use logging skills), incident response procedures (use secure-sdlc)
license	MIT
metadata	{"displayName":"Security Logging & Monitoring","author":"Tyler-R-Kendrick"}
compatibility	claude, copilot, cursor
references	[{"title":"OWASP Logging Cheat Sheet","url":"https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"},{"title":"NIST SP 800-92 Guide to Computer Security Log Management","url":"https://csrc.nist.gov/publications/detail/sp/800-92/final"},{"title":"OWASP Top Ten A09:2021 Security Logging and Monitoring Failures","url":"https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/"}]

Security Logging & Monitoring

Overview

OWASP A09:2021 — Security Logging and Monitoring Failures — highlights the critical importance of comprehensive logging and active monitoring in application security. Without adequate logging, breaches go undetected; without effective monitoring, alerts go unnoticed. Security logging is the foundation of incident detection and forensics. On average, organizations take over 200 days to detect a breach, and insufficient logging is a primary contributing factor. Every security-relevant event must be captured, stored securely, and analyzed in near real time to enable rapid detection, investigation, and response.

What to Log

Every application must log security-relevant events with enough detail to support forensic investigation and compliance audits.

Event Category	Examples	Priority
Authentication events	Login, logout, failed login attempts, password changes, MFA enrollment/bypass	Critical
Authorization failures	Access denied, privilege escalation attempts, role changes	Critical
Data access	PII read/write/delete, bulk data exports, sensitive record access	High
Configuration changes	System settings modifications, feature flag changes, security policy updates	High
Administrative actions	User creation/deletion, role assignments, permission grants, system restarts	High
Input validation failures	Rejected input, SQL injection attempts, XSS payloads, malformed requests	Medium
Application errors	Unhandled exceptions, stack traces, crash reports, resource exhaustion	Medium
API usage	Rate limit hits, deprecated endpoint calls, unusual request patterns, quota exhaustion	Medium

Critical events must trigger immediate alerts. High-priority events should be reviewed within hours. Medium-priority events should be included in daily or weekly reviews.

Audit Trail Requirements

A complete audit trail answers five fundamental questions for every security-relevant action:

• Who — The authenticated identity that performed the action (user ID, service account, API key identifier).
• What — The specific action taken (created, read, updated, deleted, configured, approved).