Monitoring and Logging
Log auth decisions and denials — never full secrets.
Visual · api_monitoring
Observability without leaking tokens. Original Cyberlium.
If you cannot see denials, you cannot defend.
Log who called what and whether authz denied. Redact Authorization and bodies with secrets. Alert on spikes of 401/403/429.
1. What to log
subject, route, method, status, latency, request id.
Authz deny reasons at a safe level of detail.
Command guide
Try these commands — What to log
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Structured logging — https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html Elastic observability — https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
curl -sS http://127.0.0.1:8819/logs/recent 2>/dev/null | jq '.[0:3]' || curl -sS http://127.0.0.1:8819/logs/recent | head -20 grep -rEn 'api[_-]?key|Authorization:' "$HOME/cyberlium-lab/t13-api" --include='*.log' 2>/dev/null | head -3 || echo 'Review YOUR lab logs — redact secrets before sharing'
Primary tools to practice this lesson: curl, grep, jq. Reference sites: Structured logging (https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html); Elastic observability (https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. What never to log
Raw passwords, full JWTs, API keys, card data.
Align with privacy lessons.
3. Alerts
Burst 401/403, 429 storms, sudden 5xx.
On-call should not need production tokens in chat to debug.
4. What you ship: logging allow/deny list
Log fields vs never-log fields. Alert ideas.
5. What you record before the next lesson
Two lists in notes.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
- Wrong: Log every Authorization header in plaintext.
- Right: Write lists. Next: checklist.
Mission: logging hygiene sheet
1) Fields to log. 2) Fields never to log. 3) One alert idea.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Safe correlation IDs?”
APPLY: Never log:
APPLY: True or False: Alert on 401 bursts can help.
APPLY: Authz denials should be:
API Security Checklist
Part of API Security with AI — Gateway Monitoring and Capstone Lab.
Capstone Lab — Full API Review
Part of API Security with AI — Gateway Monitoring and Capstone Lab.
Quiz — API Security Topic
Part of API Security with AI — Gateway Monitoring and Capstone Lab.