igbuend/log-entity-actions-pattern
skills/log-entity-actions-pattern/SKILL.md
Security pattern for implementing security logging and audit trails. Use when designing logging systems for security events, implementing non-repudiation, creating audit trails, or addressing security monitoring and incident response needs. Addresses "Entity repudiates action request" problem.
$ install --global
skillsauthnpx skillsauth add igbuend/grimbard log-entity-actions-patternInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 5, 2026, 8:18 PM19.0s1 file scanned
SKILL.md
- name:
- log-entity-actions-pattern
- description:
- Security pattern for implementing security logging and audit trails. Use when designing logging systems for security events, implementing non-repudiation, creating audit trails, or addressing security monitoring and incident response needs. Addresses "Entity repudiates action request" problem.
Log Entity Actions Security Pattern
Records entity actions to create an audit trail, enabling accountability, non-repudiation, incident investigation, and security monitoring.
Problem Addressed
Entity repudiates action request: An entity denies having performed an action, or there's no way to determine what actions occurred, who performed them, or when.
Core Components
| Role | Type | Responsibility | |------|------|----------------| | Entity | Entity | Performs actions that should be logged | | System | Entity | Processes entity requests | | Logger | Entity | Records actions to log store | | Log Store | Storage | Persists log entries | | Log Monitor | Entity | Analyzes logs for anomalies |
Data Elements
- action: The operation performed
- principal: Identity of entity performing action
- timestamp: When action occurred
- outcome: Success/failure status
- context: Additional relevant information
What to Log
Security-Relevant Events
- Authentication attempts (success and failure)
- Authorization decisions (grants and denials)
- Access to sensitive data
- Administrative operations
- Security configuration changes
- Session events (creation, termination)
Per-Event Information
- Who: Principal/user identifier
- What: Action performed
- When: Timestamp (synchronized, preferably UTC)
- Where: Source (IP, location, system)
- Outcome: Success, failure, error
- Context: Relevant parameters (without sensitive data)
What NOT to Log
Never log:
- Passwords or credentials
- Session tokens
- Encryption keys
- Full credit card numbers
- Personal data beyond necessity
- Sensitive business data
Security Considerations
Log Integrity
- Protect logs from tampering
- Detect unauthorized modifications
- Consider append-only storage
- Sign or hash log entries
Log Confidentiality
- Logs may contain sensitive information
- Restrict access to authorized personnel
- Encrypt logs at rest and in transit
Log Availability
- Ensure logging system resilience
- Handle logging failures gracefully
- Don't let logging failures stop business operations
- Alert on logging system issues
Centralized Logging
- Aggregate logs from multiple sources
- Enables correlation and analysis
- Protects against local log tampering
- Use secure transmission to central store
Log Retention
- Define retention periods
- Meet compliance requirements
- Secure deletion when expired
- Archive for long-term storage if needed
Time Synchronization
- Use NTP for consistent timestamps
- Critical for correlating events across systems
- Include timezone information (prefer UTC)
Logging Flow
Entity → [action] → System
System → [log(action, principal, timestamp, outcome)] → Logger
Logger → [store] → Log Store
Log Monitor → [analyze] → Log Store
Log Monitor → [alert] → Security Team (if anomaly)
Implementation Guidelines
Log Format
- Use structured format (JSON, key-value)
- Consistent schema across systems
- Include correlation IDs for request tracing
Log Levels
- ERROR: Security failures requiring attention
- WARN: Suspicious but not definitively malicious
- INFO: Normal security events
- DEBUG: Detailed troubleshooting (not in production)
Performance
- Asynchronous logging to avoid blocking
- Buffer and batch writes
- Monitor logging overhead
Monitoring and Alerting
- Real-time analysis for critical events
- Threshold-based alerts (e.g., failed logins)
- Pattern detection for attack identification
Common Security Events to Log
| Event | Log Level | Details to Include | |-------|-----------|-------------------| | Login success | INFO | principal, source IP, timestamp | | Login failure | WARN | attempted user, source IP, failure reason | | Authorization denied | WARN | principal, action, resource | | Admin action | INFO | principal, action, target, parameters | | Security config change | INFO | principal, what changed, old/new values | | Session timeout | INFO | principal, session duration |
Implementation Checklist
- [ ] All authentication events logged
- [ ] All authorization denials logged
- [ ] Sensitive operations logged
- [ ] No credentials in logs
- [ ] Timestamps synchronized (NTP)
- [ ] Logs protected from tampering
- [ ] Log access restricted
- [ ] Retention policy defined
- [ ] Monitoring/alerting configured
- [ ] Secure transmission to central store
Related Patterns
- Authentication (events to log)
- Authorisation (events to log)
- Data validation (events to log)
References
- Source: https://securitypatterns.distrinet-research.be/patterns/02_02_001__log_entity_actions/
- OWASP Logging Cheat Sheet
- OWASP Security Logging Vocabulary
Related Skills
igbuend/xss-anti-pattern
development
VerifiedTrustedCommunity
Security anti-pattern for Cross-Site Scripting vulnerabilities (CWE-79). Use when generating or reviewing code that renders HTML, handles user input in web pages, uses innerHTML/document.write, or builds dynamic web content. Covers Reflected, Stored, and DOM-based XSS. AI code has 86% XSS failure rate.
4SKILL.mdUpdated Apr 5, 2026
igbuend/xpath-injection-anti-pattern
development
VerifiedTrustedCommunity
Security anti-pattern for XPath injection vulnerabilities (CWE-643). Use when generating or reviewing code that queries XML documents, constructs XPath expressions, or handles user input in XML operations. Detects unescaped quotes and special characters in XPath queries.
4SKILL.mdUpdated Apr 5, 2026
igbuend/weak-password-hashing-anti-pattern
development
VerifiedTrustedCommunity
Security anti-pattern for weak password hashing (CWE-327, CWE-759). Use when generating or reviewing code that stores or verifies user passwords. Detects use of MD5, SHA1, SHA256 without salt, or missing password hashing entirely. Recommends bcrypt, Argon2, or scrypt.
4SKILL.mdUpdated Apr 5, 2026
igbuend/weak-encryption-anti-pattern
development
VerifiedTrustedCommunity
Security anti-pattern for weak encryption (CWE-326, CWE-327). Use when generating or reviewing code that encrypts data, handles encryption keys, or uses cryptographic modes. Detects DES, ECB mode, static IVs, and custom crypto implementations.
4SKILL.mdUpdated Apr 5, 2026