Web › Module 9 › Lesson 1
What Must Be Logged
A09: security-relevant events with enough context to investigate — not silence.
Visual · must_be_logged
Log lines: login fail, admin change, access deny. then append a local log of that request. Router admin STOP. No invading foreign logs.
Opening
If it never hit a log, defenders cannot prove it happened — that is an A09 failure.
OWASP Top 10:2025 A09 Security Logging and Alerting Failures starts with missing or useless security logs: no auth failures, no privilege changes, no access denials, no integrity alerts. Attacker goal: operate without a trail. Cyberlium: define a must-log list for an app YOU own — not scrape someone else’s SIEM, not disable audit on a café POS “to practice.” Practical commands: If it is a home router login, STOP — do not hydra, do not nmap. Optionally curl DEMO (or skip if router) and append a fake-safe log line of that request under cyberlium-lab. Next: alerting that matters. Today: what must be logged, with privacy still ahead in Lesson 3.
1. Security-relevant events: authn, authz, admin, integrity
Minimum set for most apps: successful and failed authentication, password/MFA changes, session revoke, authorization failures on sensitive objects, admin/config changes, input rejection on dangerous parsers, integrity verify failures, and application start with build identity. Debug chatter is not a substitute for these events.
Each event needs who/what/when/where/outcome at a level you can investigate later — without pasting secrets (Lesson 3).
Command guide
A09 Logging — Security-relevant events
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
curl -sS -m 3 -o /dev/null -w "identify_status %{http_code}
" "$DEMO/"2. Context fields: correlation without dumping wallets
Include request id, user id (not password), route, source IP if appropriate, outcome code, and resource id. Exclude passwords, tokens, full card numbers, session secrets. Structured logs (JSON lines) beat free-text grepping when you own the pipeline.
Clock sync (NTP) matters so timelines make sense across services you own.
Command guide
A09 Logging — Context fields
═══ COMMANDS ═══
Command — copy this
printf '{"request_id":"lab","user_id":"alice","route":"/identify","outcome":"ok"}
' >> "$HOME/cyberlium-lab/a09-local.jsonl"3. Retention and integrity of logs themselves
Logs attackers can wipe on the box are weak. Prefer append-only or off-box shipping for security events on systems YOU administer. Retention policy is a design choice — write yours. Do not practice log-clear on systems you do not own.
Access to logs is privileged — treat log stores like production data.
4. App vs platform: both layers
App logs catch business denials; platform logs catch process crashes and network edges. Name both for your stack. Empty “CloudWatch exists” without event types fails.
Cite A09. Original Cyberlium — not official OWASP certification.
5. Wrong vs right: silence vs must-log on your app
Same word “logging,” opposite outcome.
Wrong
Log nothing security-relevant. Log passwords. Wipe foreign hosts’ logs. Scrape classmate SIEM. Hydra the router. nmap the LAN.
Right
Identify DEMO; router → STOP. Must-log list for an app YOU own; structured fields; no secrets; lock must-log-notes.txt. Next: Alerting That Matters.
6. Hands-on: curl DEMO (optional) + local log + must-log-notes.txt
If DEMO is YOUR lab app, curl it and append a redacted local log line. Fill the checklist.
Mission: must-log-notes.txt (mode 600)
1) Optionally curl DEMO and append a redacted local log line.2) List must-log security events and fields included/excluded (no secrets) for an app YOU own or invent. 3) chmod 600 $HOME/cyberlium-lab/must-log-notes.txt. No foreign SIEM. No hydra. No nmap.
Stuck? Ask Cyberlium AI Mentor
If logging still means “print everything,” ask for a hint. Try: "Hint only: which authn/authz/admin events must appear; which fields never belong; why 192.168.0.1 router login is OUT OF SCOPE; where notes live?"
A09 begins with events you can investigate — including a local log of an identify curl you generated. Original Cyberlium — not official OWASP certification. Next — Alerting That Matters.
Knowledge Check
APPLY: App never logs failed logins or admin changes. A09?
Multiple choice
Knowledge Check
APPLY: True or False: Logging plaintext passwords helps incident response.
True or False
Knowledge Check
APPLY: curl of http://192.168.0.1/ is router admin. Hydra it so you have “real” auth-fail logs?
Multiple choice