sdlc.dev

Security basics every engineer needs path · Operating securely · Topic 14 of 16

Security logging and detection, without leaking PII

Not started

Security logging has two jobs that pull in opposite directions. It must record enough about security-relevant events to detect attacks and reconstruct what happened. And it must not become a store of passwords, tokens and personal data that is copied to every log tool, kept for years, and readable by far more people than the production database.

Why it matters: Breaches often go unnoticed for months because nothing was logged, or the logs were never looked at. Meanwhile, logs full of tokens and personal data become a breach of their own.

  1. 1Log security events

    Logins and failures, MFA changes, permission changes, access denials, admin actions, data exports. Who, what, when, from where, and the outcome.

  2. 2Alert, don't just store

    Logs nobody reads detect nothing. Define alerts for patterns that matter and route them to someone who will act.

  3. 3Keep secrets and PII out

    Never log passwords, tokens, session IDs, keys or full card numbers; minimise and mask personal data. Logs are copied widely and kept a long time.

  4. 4Protect the logs

    Send them off the host, restrict who can read them, and make them hard to alter, so an intruder can't erase their tracks.

1

How it works

The explanation, with examples you can run.

What to log

Focus on events that change or test trust:

  • authentication: logins, failures, lockouts, password resets, MFA enrolment and removal, new passkeys;
  • authorisation: access denied (403/404 on objects), privilege and role changes;
  • administration: config changes, user impersonation, feature flags on security controls;
  • data: bulk exports, downloads of sensitive records, deletions;
  • input that failed validation in suspicious ways, and errors from security controls.

For each: a timestamp in UTC, the actor (user or service ID, not their name), the action, the target, the result, source IP and user agent, and a request or trace ID to link it to other logs. Use structured logs (JSON) with consistent field names; the OWASP Logging Vocabulary offers a standard set of event names.

What never to log

Passwords (even wrong ones), session IDs, access and refresh tokens, API keys, private keys, full card numbers, and full personal records. Minimise personal data: log an internal user ID rather than an email address, and mask what you must keep. Redact at the logger, before anything leaves the process:

⌘/Ctrl + Enter
OutputNot run yet

Press Run to see what your code prints, in order.

Runs in this browser, in an isolated frame with no access to this page. console.log, info, warn and error are shown; code runs as a classic script, so use an async function for await.

Deny-lists like this are a safety net. The stronger habit is to log chosen fields explicitly rather than dumping whole request objects.

From logs to detection

Ship logs off the host to a central system quickly, so an attacker on the machine can't delete them. Then decide what should wake someone up:

  • many failed logins across many accounts from one source (credential stuffing), or many sources against one account;
  • a successful login right after many failures, or from an unusual country plus an MFA change;
  • bursts of 403 or 404 responses across sequential object IDs;
  • a new admin, a disabled audit setting, or a large export outside normal hours.

Test that alerts fire, keep the number low enough that each is investigated, and write a short runbook for each.

Protecting the logs

Restrict read access, especially to anything containing personal data. Use append-only or write-once storage for audit trails. Set retention to what investigations and law require, and no longer.

2

Check yourself

3 questions. Get them all right to finish this topic.

  1. 1.Which of these belongs in a security log entry for a failed login?
  2. 2.A user name contains a newline followed by text formatted like a log line. What should the logger do?
  3. 3.Which 2025 OWASP Top 10 category covers missing or useless security logs?

0 of 3 right so far. Get all three to finish this topic.

Go deeper