Working with Audit Logging
1. Understanding Audit Logging Requirements
| Driver | Detail |
|---|---|
| Compliance | SOC 2, ISO 27001, HIPAA, PCI DSS |
| Forensics | Reconstruct incidents |
| Accountability | Who did what, when, where |
| Detection | SIEM correlation |
2. Logging Authentication Events
| Event | Detail |
|---|---|
| login.success | user_id, method, ip, ua, mfa_used |
| login.failure | email_hash, reason, ip, ua |
| logout | user_id, session_id |
| mfa.challenge | method, outcome |
| password.change | user_id, actor |
3. Tracking Authorization Decisions
| Field | Detail |
|---|---|
| subject | User/service |
| action | Operation |
| resource | Object + id |
| decision | permit / deny |
| policy | Rule that matched |
4. Implementing User Activity Logging
| Type | Detail |
|---|---|
| Admin actions | All changes (config, users, roles) |
| Data access | Sensitive resource reads |
| Data modification | CRUD with before/after |
| Exports | Volume + destination |
5. Using Tamper-Proof Logs
| Mechanism | Detail |
|---|---|
| Append-only | WORM storage (S3 Object Lock) |
| Hash chaining | Each entry includes prev hash |
| Signed | HSM-signed log batches |
| Remote | Forward to SIEM in real time |
6. Implementing Structured Logging
Example: JSON log entry
{
"ts": "2026-05-18T18:00:00.123Z",
"level": "info",
"event": "login.success",
"user_id": "u_1",
"session_id": "s_abc",
"ip": "1.2.3.4",
"ua": "Mozilla/...",
"mfa": "webauthn",
"trace_id": "01HK..."
}7. Handling Sensitive Data in Logs
| Field | Treatment |
|---|---|
| Password | NEVER log (even in errors) |
| Tokens | Log truncated prefix only |
| PII (email) | Hash or pseudonymize for compliance |
| PAN/SSN | Mask or omit |
8. Implementing Log Retention Policies
| Regulation | Period |
|---|---|
| SOX | 7 years |
| PCI DSS | 1 year (3 months online) |
| HIPAA | 6 years |
| GDPR | Minimize — no longer than necessary |
9. Using Centralized Logging
| Stack | Detail |
|---|---|
| ELK / OpenSearch | Elasticsearch + Logstash + Kibana |
| Splunk | Commercial SIEM |
| Datadog, Sumo | SaaS |
| Loki | Grafana — cheap log aggregation |
10. Implementing Real-Time Alerting
| Trigger | Action |
|---|---|
| 5+ failed logins / 5 min | Alert + temp lockout |
| Login from new country | Notify user |
| Admin role assigned | Page security |
| Privilege escalation | Immediate Slack/PagerDuty |
11. Handling Compliance Requirements
- Log all access to ePHI (HIPAA §164.312(b))
- Audit trail integrity (SOX §404)
- Retain authentication logs (PCI DSS 10.7)
- User notification of data breaches (GDPR 72-hour rule)