log-entity-actions-pattern

name	log-entity-actions-pattern
description	Security pattern for implementing security logging and audit trails. Use when designing logging systems for security events, implementing non-repudiation, creating audit trails, or addressing security monitoring and incident response needs. Addresses "Entity repudiates action request" problem.

Log Entity Actions Security Pattern

Records entity actions to create an audit trail, enabling accountability, non-repudiation, incident investigation, and security monitoring.

Problem Addressed

Entity repudiates action request: An entity denies having performed an action, or there's no way to determine what actions occurred, who performed them, or when.

Core Components

Role	Type	Responsibility
Entity	Entity	Performs actions that should be logged
System	Entity	Processes entity requests
Logger	Entity	Records actions to log store
Log Store	Storage	Persists log entries
Log Monitor	Entity	Analyzes logs for anomalies

Data Elements

• action: The operation performed
• principal: Identity of entity performing action
• timestamp: When action occurred
• outcome: Success/failure status
• context: Additional relevant information

What to Log

Security-Relevant Events