What security events should be logged?

Direct answer

What a strong answer covers

How it works

Security logs exist to answer who did what to which resource, when, from where, and whether it succeeded, both for real-time detection and for reconstruction after the fact. That means logging authentication attempts with outcome and factor, authorisation decisions especially denials, changes to privileges, roles, and policies, access to secrets and keys, reads and exports of sensitive data, administrative and configuration actions, input validation failures that suggest probing, and events from security controls such as firewalls and scanners. Each record carries a timestamp in UTC, the acting identity, the target, the outcome, and a request ID; logs are shipped to a store the application cannot alter and retained according to policy.

Example

A SaaS platform logs every login with factor and device, every denied authorisation with the resource and policy, every secret read from the vault with the identity and lease, and every bulk export with the row count. Detection rules alert on a user reading more than 10 secrets in a minute and on exports from a new location. During a compromised-account investigation, those logs showed the exact sequence of privilege changes and data access within minutes.

Common mistakes

• Logging request bodies with passwords and tokens inside.
• Recording successes but not denials, which is where probing shows up.
• Keeping logs on the same host an attacker can wipe.

A useful answer structure

Answer from your own work.

Do not memorise a script: use only examples you can explain honestly in follow-up questions.