Generate Secure and Compliant Audit Logs

This skill designs, implements, and generates security and compliance audit logs, covering regulatory requirements (SOX, GDPR, HIPAA, PCI-DSS), structured log formats, retention policies, and security best practices for audit trails. Every log entry follows a fixed schema: a millisecond-precision UTC timestamp, a unique event ID for correlation, the actor (user ID or service account), the action (CREATE, READ, UPDATE, DELETE), the resource affected (table, file, or record ID), the source (IP address, application, or system), the result (success, failure, or partial completion), and a risk-level classification (critical, high, medium, low). Log integrity requirements mandate append-only immutability after write, cryptographic signatures for tamper detection, storage separated from operational systems, regular integrity verification, and chain-of-custody documentation.

Use it when designing or generating audit logs that must hold up under regulatory review - SOX financial-data tracking, GDPR lawful-basis and cross-border-transfer context, or HIPAA PHI handling. It is not a general application-logging skill: audit logs generated this way are deliberately immutable, tamper-evident, and stored separately from operational systems, which adds overhead not appropriate for routine debug logging.

Given an event to log, it outputs a structured entry in one of two formats: a recommended JSON format (nested actor, resource, context, result, and metadata objects including compliance tags, retention years, and a checksum) or CEF (Common Event Format) for SIEM ingestion. It classifies events into four categories: authentication (login attempts, password changes, MFA activations, account lockouts, privilege escalations), data access (with data classification, access method, record count, and a query hash), administrative (configuration changes, access grants and revocations, permission changes, maintenance, backup and restore), and security (failed authorization attempts, anomalous access patterns, policy violations, incident response actions). For state-changing operations it also supports before/after state tracking with a change reason and approver, and batch-operation logging with total, successful, and failed record counts plus processing duration.

{
  "timestamp": "2024-01-15T14:30:45.123Z",
  "event_id": "evt_7f4a9b2c8e1d",
  "version": "1.0",
  "actor": {
    "user_id": "john.doe@company.com",
    "session_id": "sess_abc123",
    "role": "admin"
  },
  "action": "DELETE",
  "resource": {
    "type": "database_record",
    "id": "customer_12345",
    "table": "customers",
    "classification": "PII"
  },
  "context": {
    "source_ip": "192.168.1.100",
    "user_agent": "Mozilla/5.0...",
    "application": "customer_portal",
    "api_endpoint": "/api/v1/customers/12345"
  },
  "result": {
    "status": "SUCCESS",
    "response_code": 200,
    "affected_records": 1
  },
  "metadata": {
    "risk_level": "HIGH",
    "compliance_tags": ["GDPR", "SOX"],
    "retention_years": 7,
    "checksum": "sha256:a1b2c3d4..."
  }
}

Adds compliance-specific context blocks per regulation: GDPR (lawful basis, data subject ID, processing purpose, retention justification, cross-border transfer flag), SOX (financial-data access tracking, segregation of duties, change-management documentation, executive access monitoring), and HIPAA (PHI involvement, minimum-necessary standard, covered entity, business associate, patient authorization). Security controls layer on top: AES-256 encryption at rest and TLS 1.3 in transit with per-log-type keys rotated at least quarterly, role-based log access policies (separate read, search, export, and retention-management permissions), and tamper detection via Merkle trees, PKI digital signatures, and immutable timestamp services.

Security, compliance, and platform engineering teams who need audit logs built for regulatory review from the start - with defined retention policies (for example, authentication logs kept 3 years with 90 days hot storage, security incidents kept 10 years with 1095 days hot storage), performance practices like async and buffered writes with graceful degradation on logging failure, and real-time alerting on failed-authentication spikes, privileged-access patterns, and data-exfiltration indicators, plus daily, weekly, monthly, and quarterly compliance reporting.