Log Entity Actions Security Pattern

Records entity actions to create an audit trail, enabling accountability, non-repudiation, incident investigation, and security monitoring.

Problem Addressed

Entity repudiates action request: An entity denies having performed an action, or there’s no way to determine what actions occurred, who performed them, or when.

Core Components

Data Elements

• action: The operation performed
• principal: Identity of entity performing action
• timestamp: When action occurred
• outcome: Success/failure status
• context: Additional relevant information

What to Log

Security-Relevant Events

• Authentication attempts (success and failure)
• Authorization decisions (grants and denials)
• Access to sensitive data
• Administrative operations
• Security configuration changes
• Session events (creation, termination)

Per-Event Information

• Who: Principal/user identifier
• What: Action performed
• When: Timestamp (synchronized, preferably UTC)
• Where: Source (IP, location, system)
• Outcome: Success, failure, error
• Context: Relevant parameters (without sensitive data)

What NOT to Log

Never log:

• Passwords or credentials
• Session tokens
• Encryption keys
• Full credit card numbers
• Personal data beyond necessity
• Sensitive business data

Security Considerations

Log Integrity

• Protect logs from tampering
• Detect unauthorized modifications
• Consider append-only storage
• Sign or hash log entries

Log Confidentiality

• Logs may contain sensitive information
• Restrict access to authorized personnel
• Encrypt logs at rest and in transit

Log Availability

• Ensure logging system resilience
• Handle logging failures gracefully
• Don’t let logging failures stop business operations
• Alert on logging system issues

Centralized Logging

• Aggregate logs from multiple sources
• Enables correlation and analysis
• Protects against local log tampering
• Use secure transmission to central store

Log Retention

• Define retention periods
• Meet compliance requirements
• Secure deletion when expired
• Archive for long-term storage if needed

Time Synchronization

• Use NTP for consistent timestamps
• Critical for correlating events across systems
• Include timezone information (prefer UTC)

Logging Flow

Entity → [action] → System
System → [log(action, principal, timestamp, outcome)] → Logger
Logger → [store] → Log Store
Log Monitor → [analyze] → Log Store
Log Monitor → [alert] → Security Team (if anomaly)

Implementation Guidelines

Log Format

• Use structured format (JSON, key-value)
• Consistent schema across systems
• Include correlation IDs for request tracing

Log Levels

• ERROR: Security failures requiring attention
• WARN: Suspicious but not definitively malicious
• INFO: Normal security events
• DEBUG: Detailed troubleshooting (not in production)

Performance

• Asynchronous logging to avoid blocking
• Buffer and batch writes
• Monitor logging overhead

Monitoring and Alerting

• Real-time analysis for critical events
• Threshold-based alerts (e.g., failed logins)
• Pattern detection for attack identification

Common Security Events to Log

Implementation Checklist

• All authentication events logged
• All authorization denials logged
• Sensitive operations logged
• No credentials in logs
• Timestamps synchronized (NTP)
• Logs protected from tampering
• Log access restricted
• Retention policy defined
• Monitoring/alerting configured
• Secure transmission to central store

Related Patterns

• Authentication (events to log)
• Authorisation (events to log)
• Data validation (events to log)

References

• Source: https://securitypatterns.distrinet-research.be/patterns/02_02_001__log_entity_actions/
• OWASP Logging Cheat Sheet
• OWASP Security Logging Vocabulary