Detect, respond, and recover
Log useful security events
Record authentication, authorization, configuration, data-access, and administrative events without leaking credentials or sensitive payloads.
8 minute lesson
If an incident happens, we need evidence. A log should answer who did what, when, where, and whether it succeeded.
Use stable event names, timestamps, actor and target identifiers, outcomes, and request correlation IDs. Never log passwords, raw session tokens, reset links, private keys, or unnecessary personal data. Protect and retain logs deliberately.
A login event records “failed” but no safe account identifier, source, or request ID. During an attack, responders cannot separate one mistyped password from thousands of guesses.
Logging the submitted password would add evidence by creating a second breach. Record enough context to correlate behavior without storing credentials.
Trigger one successful login, one failed login, and one denied cross-user read. Verify the events share stable names and request IDs, then search the captured logs for raw passwords, session tokens, and reset links.
Lesson completed