Intermediate LevelAuthentication & Authorization
What security attributes must be captured in Authentication Audit Logs?
❓ Interview Prompt: Explain security audit logging, SIEM integration, log sanitization, and capturing authentication metadata.
Authentication Audit Logs provide essential forensics needed during security incident investigations and compliance audits (SOC 2, ISO 27001, HIPAA).
Essential Log Attributes:
1
Timestamp: UTC ISO 8601 timestamp ('2026-07-27T12:00:00.000Z').
2
Event Type: 'LOGIN_SUCCESS', 'LOGIN_FAILURE', 'PASSWORD_RESET_REQUEST', 'MFA_CHALLENGE_FAILED'.
3
Actor Identity: Target User ID, Subject claim, or attempted username.
4
Context: Client IP address, User-Agent, Session ID hash.
5
Failure Reason: 'INVALID_PASSWORD', 'USER_NOT_FOUND', 'MFA_TIMEOUT'.
CRITICAL SANITIZATION RULE:
NEVER log raw passwords, credit cards, or raw JWT secret tokens inside log files!
Code Implementation Example
typescript
function logAuthEvent(event: { type: string; userId?: string; attemptedUser: string; ip: string; status: 'SUCCESS' | 'FAILURE'; reason?: string }) {
const auditEntry = {
timestamp: new Date().toISOString(),
event: event.type,
userId: event.userId || null,
attemptedUser: event.attemptedUser, // Sanitized text
clientIp: event.ip,
status: event.status,
reason: event.reason || null
};
logger.info('AUTH_AUDIT_LOG', auditEntry);
}💡Constructing structured authentication security audit log entries.
🎯 Interview Key Takeaway
Audit logs must capture event types, UTC timestamps, actor IDs, IP context, and failure reasons while redacting cleartext passwords.
#Audit Logging#SIEM#Security#Compliance#Intermediate
Back to all Authentication & Authorization Questions→