audit-logging

1# Audit Logging
2 
3Implement comprehensive audit logging for compliance, security monitoring, and forensic analysis across infrastructure and applications.
4 
5## When to Use
6 
7- Setting up centralized logging for compliance frameworks (SOC 2, HIPAA, PCI DSS)
8- Implementing security event monitoring and alerting
9- Building audit trails for regulatory requirements
10- Configuring log retention and tamper-proof storage
11- Integrating application logs with SIEM platforms
12 
13## Log Categories
14 
15```yaml
16audit_events:
17  authentication:
18    - Login attempts (success and failure)
19    - MFA enrollment and verification events
20    - Session creation, renewal, and termination
21    - Password changes and resets
22    - API key and token generation
23 
24  authorization:
25    - Access grants and denials
26    - Permission changes and role assignments
27    - Privilege escalation events
28    - Resource sharing modifications
29    - Policy evaluation results
30 
31  data_access:
32    - Read operations on sensitive data
33    - Write and update operations
34    - Delete and purge operations
35    - Bulk export and download events
36    - Data classification changes
37 
38  administrative:
39    - Configuration changes
40    - User and group management
41    - System startup and shutdown
42    - Backup and restore operations
43    - Network and firewall rule changes
44 
45  system:
46    - Service health state changes
47    - Resource provisioning and deprovisioning
48    - Certificate and key rotation events
49    - Scheduled job execution results
50…