You cannot defend what you cannot see—logs and alerts detect brute force, data exfiltration, and privilege changes.
What to log
- Auth success/failure (no passwords)
- Admin actions and permission changes
- Validation failures and rate limits
- Correlation id per request
What not to log
Full credit cards, government IDs, raw session tokens, health data—minimize PII in logs.
SIEM preview
Centralize logs; alert on anomalies; runbooks for on-call—tie to CloudWatch preview.
Important interview questions and answers
- Q: Log injection?
A: Sanitize newlines in user input written to logs. - Q: Retention?
A: Balance investigation needs with storage cost and privacy.
Self-check
- Name three security-relevant events to log.
- What should you avoid logging?
Tip: Alert on spike in 401/403 and admin role grants.
Interview prep
- Log passwords?
Never—log events without secrets.