Log auth events (login failures, MFA changes), privilege changes, access to sensitive data, and unusual traffic patterns. Monitor for spikes, geo-anomalies, and failed actions to detect abuse early and support incident response.
Security logs must be actionable and privacy-aware:
Minimal log schema:
{ userId, action, target, result, ip, userAgent, traceId }