design-security-logging

Use when adding logging to authentication flows, authorization decisions, admin actions, or any security-sensitive operation — to enable detection, forensics, and incident response.

Ir para a instalação

Repositório: jeffreytse/grimoire-hub
Última atividade na origem: 22 de junho de 2026 às 17:16
Idioma detectado do SKILL.md: inglês
Estrelas: 0
Forks: 0

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/jeffreytse/grimoire-hub --skill design-security-logging

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

Design Security Logging

Log security-relevant events with sufficient context for forensics while preventing log injection and avoiding logging sensitive data — enabling detection and investigation of attacks, breaches, and insider threats.

Why This Is Best Practice

Adopted by: OWASP Top 10 2021 A09 (Security Logging and Monitoring Failures) is its own category. PCI DSS v4.0 Requirement 10 mandates audit logging for cardholder data environments with 12-month retention. NIST SP 800-92 (Guide to Computer Security Log Management) is the authoritative federal reference. SOC 2 Type II, ISO 27001, and HIPAA all require audit logging with tamper evidence. AWS, GCP, and Azure provide CloudTrail/Cloud Audit Logs/Activity Logs as core compliance features. Impact: The Equifax breach (2017, 147M records) went undetected for 76 days partly due to insufficient logging — OWASP A09 was directly cited in post-mortem analysis. Capital One breach detection (2019) was triggered by an AWS CloudTrail anomaly alert, limiting the window. NIST estimates proper logging reduces mean time to detect (MTTD) breaches by 63 days on average (IBM Cost of a Data Breach Report 2023). or unstructured log lines are the alternative — they're unsearchable at scale, don't aggregate, and lack the structured fields needed for SIEM correlation. Structured JSON logs with consistent field names enable automated alerting, SIEM ingestion (Splunk, DataDog, Elastic), and cross-service correlation of attack chains.

name	design-security-logging
description	Use when adding logging to authentication flows, authorization decisions, admin actions, or any security-sensitive operation — to enable detection, forensics, and incident response.
source	OWASP Logging Cheat Sheet (owasp.org/www-project-cheat-sheets); OWASP Top 10 2021 A09; NIST SP 800-92; CWE-778; PCI DSS v4.0 Requirement 10
tags	["security","owasp","logging","monitoring","audit-trail","incident-response","developer","devops"]

Design Security Logging

Why This Is Best Practice

Event

Log level

Fields required

INFO

user_id, ip, user_agent, timestamp

WARN

username_attempted, ip, reason, timestamp

Logout

INFO

user_id, session_id, timestamp

Password change

INFO

user_id, ip, changed_by, timestamp

Permission change

WARN

user_id, changed_by, old_role, new_role, timestamp

Admin action

WARN

admin_id, action, target, ip, timestamp

Access denied (403)

WARN

user_id, resource, ip, timestamp

Input validation failure

INFO

ip, endpoint, field, reason

import structlog import logging logger = structlog.get_logger() def log_auth_event(event, user_id, ip, **kwargs): logger.info( "auth_event", event=event, user_id=user_id, ip=ip, timestamp=datetime.utcnow().isoformat() + 'Z', **kwargs ) # Usage log_auth_event("login_success", user_id=42, ip=request.remote_addr) log_auth_event("login_failure", user_id=None, ip=request.remote_addr, username_attempted=username[:50], reason="invalid_password")

# BAD logger.info("login", password=request.form['password']) # GOOD — log outcome, not credential logger.info("login", user_id=user.id, success=True) # Mask sensitive fields if partial logging needed def mask(value, visible=4): return '*' * (len(value) - visible) + value[-visible:] logger.info("card", last4=mask(card_number))

import re def sanitize_for_log(value, max_length=200): if not isinstance(value, str): value = str(value) # Remove newlines (log injection vector — splits one log entry into two) value = re.sub(r'[\r\n]', ' ', value) return value[:max_length] logger.info("user_action", username=sanitize_for_log(request.form['username']))

# Example: alert on brute-force (>5 login failures from one IP in 5 minutes) alert: brute_force_attempt condition: count(event=login_failure, ip=same) > 5 within 5m action: [notify_security_team, temp_block_ip]

design-security-logging

Opções de instalação

Revise os arquivos de origem

Design Security Logging

Why This Is Best Practice

Design Security Logging

Why This Is Best Practice

Steps

Rules

Common Mistakes

Event	Log level	Fields required
Login success	INFO	user_id, ip, user_agent, timestamp
Login failure	WARN	username_attempted, ip, reason, timestamp
Logout	INFO	user_id, session_id, timestamp
Password change	INFO	user_id, ip, changed_by, timestamp
Permission change	WARN	user_id, changed_by, old_role, new_role, timestamp
Admin action	WARN	admin_id, action, target, ip, timestamp
Access denied (403)	WARN	user_id, resource, ip, timestamp
Input validation failure	INFO	ip, endpoint, field, reason

design-security-logging

Informações da origem

Opções de instalação

Revise os arquivos de origem

Mais deste repositório

Mais deste repositório

Design Security Logging

Why This Is Best Practice

Design Security Logging

Why This Is Best Practice

Steps

Rules

Common Mistakes