<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-secure-logging-practices
description: >-
  Build logging systems that support security monitoring without exposing sensitive data.
domain: cybersecurity
subdomain: secure-coding
tags:
  - logging
  - monitoring
  - secure-coding
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1070"]
---

# Implementing Secure Logging Practices

## Overview

Build logging systems that support security monitoring without exposing sensitive data.

## Prerequisites

| Requirement | Install |
|---|---|
| Structured logging | JSON format |
| Log aggregation | ELK/Splunk |
| Python 3.10+ | For agent tooling |

## Key Concepts

Secure logging captures security events without sensitive data.
Structured JSON logging, PII redaction, tamper-proof storage.

## Quick Reference

```bash
import structlog; logger = structlog.get_logger()
node agent.js audit --directory src/ --check logging
node agent.js scan --directory src/ --pattern 'password'
node agent.js configure --component log-redactor --fields email,ssn
```

## Workflow

1. Structured logging
2. PII redaction
3. Security events
4. Log rotation
5. Tamper-proof storage
6. Retention policy
7. Monitor pipeline

## Detection

```yaml
title: Secure Logging Practices Detection
id: 1e50382d-fbbc-4c07-899c-4b7aa823d521
status: experimental
description: Detects suspicious activity related to implementing secure logging practices techniques in secure coding context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1070
  - attack.initial_access
falsepositives:
  - Static analysis tools scanning source code repositories
```

## Verification

- Structured format
- PII redacted
- Security events logged
- Rotation works
- Retention policy

## References

- OWASP Testing Guide — https://owasp.org/www-project-web-security-testing-guide/
- MITRE ATT&CK — https://attack.mitre.org/
- NIST SP 800-53 — https://csf.tools/reference/nist-sp-800-53/
