Security Event Logging — Logging Security-Relevant Events

// Security event logger
class SecurityLogger {
  constructor() {
    this.events = {
      AUTH_SUCCESS: { severity: 'info', category: 'authentication' },
      AUTH_FAILURE: { severity: 'warn', category: 'authentication' },
      AUTH_MFA_REQUIRED: { severity: 'info', category: 'authentication' },
      TOKEN_REFRESHED: { severity: 'info', category: 'session' },
      TOKEN_REVOKED: { severity: 'warn', category: 'session' },
      AUTHORIZATION_DENIED: { severity: 'warn', category: 'authorization' },
      RATE_LIMIT_EXCEEDED: { severity: 'warn', category: 'abuse' },
      SUSPICIOUS_IP: { severity: 'high', category: 'threat' },
      DATA_ACCESS: { severity: 'info', category: 'privacy' },
      PRIVILEGE_ESCALATION: { severity: 'high', category: 'authorization' },
      ADMIN_ACTION: { severity: 'info', category: 'administration' }
    };
  }

  log(eventType, metadata = {}) {
    const definition = this.events[eventType];
    if (!definition) throw new Error(`Unknown security event: ${eventType}`);

    const entry = {
      type: 'security',
      eventType,
      severity: definition.severity,
      category: definition.category,
      timestamp: new Date().toISOString(),
      eventId: uuidv4(),
      actor: metadata.actor,
      target: metadata.target,
      resource: metadata.resource,
      ip: metadata.ip,
      userAgent: metadata.userAgent,
      sessionId: metadata.sessionId,
      correlationId: metadata.correlationId,
      details: metadata.details,
      result: metadata.result,
      reason: metadata.reason
    };

    logger.warn(entry, `[SECURITY] ${eventType}: ${metadata.details || ''}`);

    // Alert on high severity events
    if (definition.severity === 'high' || definition.severity === 'critical') {
      this.alertSecurityTeam(entry);
    }

    // Send to SIEM
    this.sendToSIEM(entry);

    return entry;
  }

  async alertSecurityTeam(event) {
    await slackClient.send({
      channel: '#security-alerts',
      text: `*${event.severity.toUpperCase()}*: ${event.eventType}`,
      attachments: [{
        fields: [
          { title: 'Actor', value: event.actor, short: true },
          { title: 'IP', value: event.ip, short: true },
          { title: 'Resource', value: event.resource },
          { title: 'Details', value: event.details }
        ],
        ts: new Date(event.timestamp).getTime() / 1000,
        color: event.severity === 'critical' ? 'danger' : 'warning'
      }]
    });
  }

  async sendToSIEM(event) {
    await axios.post(process.env.SIEM_ENDPOINT, event, {
      headers: { 'X-API-Key': process.env.SIEM_API_KEY }
    });
  }
}

// Usage
securityLogger.log('AUTH_FAILURE', {
  actor: 'user@example.com',
  ip: req.ip,
  details: 'Invalid password - 3rd attempt in 5 minutes'
});