AgentSkillsCN

log-entity-actions

在实施安全日志与审计追踪方面的安全模式。在设计用于安全事件的日志系统、实现非否认性、创建审计追踪，或应对安全监控与事件响应需求时，可参考此模式。该模式专门应对“实体否认操作请求”的问题。

SKILL.md
--- frontmatter
name: log-entity-actions
description: Security pattern for implementing security logging and audit trails. Use when designing logging systems for security events, implementing non-repudiation, creating audit trails, or addressing security monitoring and incident response needs. Addresses "Entity repudiates action request" problem.

Log Entity Actions Security Pattern

Records entity actions to create an audit trail, enabling accountability, non-repudiation, incident investigation, and security monitoring.

Problem Addressed

Entity repudiates action request: An entity denies having performed an action, or there's no way to determine what actions occurred, who performed them, or when.

Core Components

RoleTypeResponsibility
EntityEntityPerforms actions that should be logged
SystemEntityProcesses entity requests
LoggerEntityRecords actions to log store
Log StoreStoragePersists log entries
Log MonitorEntityAnalyzes logs for anomalies

Data Elements

  • •action: The operation performed
  • •principal: Identity of entity performing action
  • •timestamp: When action occurred
  • •outcome: Success/failure status
  • •context: Additional relevant information

What to Log

Security-Relevant Events

  • •Authentication attempts (success and failure)
  • •Authorization decisions (grants and denials)
  • •Access to sensitive data
  • •Administrative operations
  • •Security configuration changes
  • •Session events (creation, termination)

Per-Event Information

  • •Who: Principal/user identifier
  • •What: Action performed
  • •When: Timestamp (synchronized, preferably UTC)
  • •Where: Source (IP, location, system)
  • •Outcome: Success, failure, error
  • •Context: Relevant parameters (without sensitive data)

What NOT to Log

Never log:

  • •Passwords or credentials
  • •Session tokens
  • •Encryption keys
  • •Full credit card numbers
  • •Personal data beyond necessity
  • •Sensitive business data

Security Considerations

Log Integrity

  • •Protect logs from tampering
  • •Detect unauthorized modifications
  • •Consider append-only storage
  • •Sign or hash log entries

Log Confidentiality

  • •Logs may contain sensitive information
  • •Restrict access to authorized personnel
  • •Encrypt logs at rest and in transit

Log Availability

  • •Ensure logging system resilience
  • •Handle logging failures gracefully
  • •Don't let logging failures stop business operations
  • •Alert on logging system issues

Centralized Logging

  • •Aggregate logs from multiple sources
  • •Enables correlation and analysis
  • •Protects against local log tampering
  • •Use secure transmission to central store

Log Retention

  • •Define retention periods
  • •Meet compliance requirements
  • •Secure deletion when expired
  • •Archive for long-term storage if needed

Time Synchronization

  • •Use NTP for consistent timestamps
  • •Critical for correlating events across systems
  • •Include timezone information (prefer UTC)

Logging Flow

code
Entity → [action] → System
System → [log(action, principal, timestamp, outcome)] → Logger
Logger → [store] → Log Store
Log Monitor → [analyze] → Log Store
Log Monitor → [alert] → Security Team (if anomaly)

Implementation Guidelines

Log Format

  • •Use structured format (JSON, key-value)
  • •Consistent schema across systems
  • •Include correlation IDs for request tracing

Log Levels

  • •ERROR: Security failures requiring attention
  • •WARN: Suspicious but not definitively malicious
  • •INFO: Normal security events
  • •DEBUG: Detailed troubleshooting (not in production)

Performance

  • •Asynchronous logging to avoid blocking
  • •Buffer and batch writes
  • •Monitor logging overhead

Monitoring and Alerting

  • •Real-time analysis for critical events
  • •Threshold-based alerts (e.g., failed logins)
  • •Pattern detection for attack identification

Common Security Events to Log

EventLog LevelDetails to Include
Login successINFOprincipal, source IP, timestamp
Login failureWARNattempted user, source IP, failure reason
Authorization deniedWARNprincipal, action, resource
Admin actionINFOprincipal, action, target, parameters
Security config changeINFOprincipal, what changed, old/new values
Session timeoutINFOprincipal, session duration

Implementation Checklist

  • • All authentication events logged
  • • All authorization denials logged
  • • Sensitive operations logged
  • • No credentials in logs
  • • Timestamps synchronized (NTP)
  • • Logs protected from tampering
  • • Log access restricted
  • • Retention policy defined
  • • Monitoring/alerting configured
  • • Secure transmission to central store

Related Patterns

  • •Authentication (events to log)
  • •Authorisation (events to log)
  • •Data validation (events to log)

References