authn_login_success event logging
Log all successful login events with the event name 'authn_login_success' followed by userid. Level is INFO. Example: event='authn_login_success:joebob1'.
OWASP Cheat Sheets · all subjects
logging/authentication
12 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
authn_login_fail event logging
Log all failed login attempts with the event name 'authn_login_fail' followed by userid. Level is WARN. Example: event='authn_login_fail:joebob1'.
authn_login_successafterfail event logging
Log successful login after one or more failures with the event name 'authn_login_successafterfail' followed by userid and retry count. Level is INFO. Example: event='authn_login_successafterfail:joebob1,2' indicates user logged in successfully after 2 failed attempts.
authn_login_fail_max event logging
Log when a user reaches the maximum number of failed login attempts with event name 'authn_login_fail_max' followed by userid and the maximum limit as integer. Level is WARN. Example: event='authn_login_fail_max:joebob1,3' indicates user reached fail limit of 3.
authn_login_lock event logging with reasons
Log account locks with event name 'authn_login_lock' followed by userid and reason. Level is WARN. Reason must be one of: maxretries (maximum retries reached), suspicious (suspicious activity observed), customer (customer requested lock), or other. Example: event='authn_login_lock:joebob1,maxretries'.
authn_password_change event logging
Log every password change with event name 'authn_password_change' followed by userid. Level is INFO. Example: event='authn_password_change:joebob1'.
authn_password_change_fail event logging
Log failed password change attempts with event name 'authn_password_change_fail' followed by userid. Level is CRITICAL. Example: event='authn_password_change_fail:joebob1'. May trigger other events such as authn_login_lock.
authn_impossible_travel event logging
Log when a user is detected accessing the application from two distant locations that are physically impossible to travel between in the time elapsed. Event name is 'authn_impossible_travel' followed by userid, region1, and region2. Level is CRITICAL. Example: event='authn_impossible_travel:joebob1,US-OR,CN-SH'.
authn_token_created event logging
Log when a token is created for service access with event name 'authn_token_created' followed by userid and entitlements (comma-separated). Level is INFO. Example: event='authn_token_created:app.foobarapi.prod,create,read,update'.
authn_token_revoked event logging
Log when a token is revoked with event name 'authn_token_revoked' followed by userid and tokenid. Level is INFO. Example: event='authn_token_revoked:app.foobarapi.prod,xyz-abc-123-gfk'.
authn_token_reuse event logging
Log when a previously revoked token is attempted to be reused with event name 'authn_token_reuse' followed by userid and tokenid. Level is CRITICAL. Example: event='authn_token_reuse:app.foobarapi.prod,xyz-abc-123-gfk'.
authn_token_delete event logging
Log when a token is deleted with event name 'authn_token_delete' followed by appid. Level is WARN. Example: event='authn_token_delete:foobarapi'.