# Security Logging, Detection and Incident Response — DevSecOps

Source: https://www.skillbyai.com/en/devsecops/dso-detect-respond

> Decide what to log for security, keep secrets out of logs, and follow an incident response sequence.

## If it is not logged, it did not happen

Prevention fails eventually, so you need to **detect** and **respond**. Log security-relevant events with enough context to reconstruct what happened: logins and failures, permission changes, access to sensitive records, admin actions, deploys, and denied requests, each with a timestamp, actor, source IP and request ID. Send logs to a central, tamper-resistant store, because an attacker with server access may delete local files. Equally important is what **not** to log: passwords, tokens, full card numbers and unnecessary personal data. Detection rules then alert on patterns, such as many failed logins followed by a success or a new cloud access key created at night. When an alert becomes an incident, follow a known sequence, commonly described as **prepare, detect and analyse, contain, eradicate, recover, and learn**. Write runbooks before you need them, and finish with a blameless review that produces pipeline or design changes.

## Redacting secrets before they reach logs

A logging filter that masks bearer tokens and password fields in every message.

```python
import logging, re, sys

class Redact(logging.Filter):
    PATTERNS = [(re.compile(r"(Bearer\s+)[\w.-]+"), r"\1[REDACTED]"),
                (re.compile(r"(password=)\S+"), r"\1[REDACTED]")]
    def filter(self, record):
        msg = record.getMessage()
        for pat, repl in self.PATTERNS:
            msg = pat.sub(repl, msg)
        record.msg, record.args = msg, None
        return True

log = logging.getLogger("auth")
handler = logging.StreamHandler(sys.stdout)
handler.addFilter(Redact())
log.addHandler(handler)
log.setLevel(logging.INFO)
log.info("login user=asha password=hunter2 ip=10.0.0.7")
log.info("call upstream with Authorization: Bearer eyJhbGciOi.abc.def")
```

Output:

```
login user=asha password=[REDACTED] ip=10.0.0.7
call upstream with Authorization: Bearer [REDACTED]
```

## CCTV and a fire drill

CCTV (logging) is useless if nobody watches the alerts, and a fire is no time to discover nobody knows the exits. Detection and rehearsed runbooks work together.

**Quiz:** During an incident, what usually comes right after confirming and analysing the attack?

- [ ] Writing the blameless review
- [ ] Buying a new security tool
- [x] Containment, to stop further damage
- [ ] Deleting all logs

*Answer:* Containment, to stop further damage. After detection and analysis, you contain the attacker before eradicating the cause and recovering.