1. Attack Protection
  • Overview
  • Application Guides
    • Frontend
      • Get Started - React App
      • Get Started - HTML and JS
      • Get Started - Angular JS
      • Get Started - Next JS App
    • Backend
      • Get Started - Node JS
      • Get Started - Golang
      • Get Started - ASP.NET
      • Get Started - JAVA
  • Dashboard
    • API Credentials
    • Organization
    • Social Login
    • Customize Email Template
    • Configure Custom Domain
    • IT Admin Portal
  • Authentication
    • Login Widget
    • Magic Link
    • Google Social Login
    • Multi-Factor Authentication
    • Single Sign-On Overview
    • Setup SSO Connection
  • Security
    • Overview
    • Authentication
      • Password Hashing and Storage
      • Multi-Factor Authentication Methods and Implementation
      • Session Management
    • Attack Protection
      • Bot Detection
      • Breached Password Detection
      • Brute Force Protection
      • Log Events
      • Secure JSON Web Tokens (JWT)
      • Secure OpenID Connect (OIDC)
      • Suspicious IP Throttling
    • Data Security
      • Data Encryption At Rest and In Transit
      • Secure Storage of Secrets (Keys, Credentials)
      • Sensitive Data Handling
    • Infrastructure
      • Security Considerations for Cloud Provider or Deployment Model
      • Threat Modeling
  • API References
    • Authentication
      • MagicLink
        • Email a Magic Link
        • Resend Email Magic Link
        • Verify Magic Link
        • Ping Status
      • Magic Auth Code
        • Email a Magic Auth Code
        • Resend Magic Auth Code
        • Verify Magic Auth Code
      • Phone Authentication
        • Send Magic Auth Code via SMS
        • Resend Magic Auth Code via SMS
        • Phone Magic Auth Verify
      • PassKey
        • Initiate Passkey Login
        • Passkey Registration Initialize
        • Finish Passkey Authentication
        • Complete Passkey Registration
        • Check User Passkey Authentication Status
        • List User PassKey Credentials
        • Update Passkey Name
        • Delete Associated Passkey
      • GET Auth Status
    • Token
      • Refresh Token
      • Access Token By Auth Code
    • Mutli-Factor Authentication (MFA)
      • MFA Access Token
      • List of Authenticators
      • MFA Enroll TOTP
      • Initiate MFA
      • QR Code Image API
      • Validate MFA Token
      • Get Backup Code
    • Role And Permission
      • List All Roles
      • List All Permission
      • Create New Role
      • Update Existing Role
      • Update Permission By Permission Id
      • Remove Organization Role By Role Id
      • Remove Organization Permission By Permission Id
    • User Management
      • List All Users
      • GET User By User Id
      • GET User by User Email Address
      • Create a User
      • Update User by User Id
      • Verify User Status By User Id
      • Delete User By User Id
      • Manage User Roles
      • GET Users Organizations
      • GET User Login Logs
    • Organization
      • Add New Organization
      • Get Organization
      • Get All Organization
      • Update Organization
      • Delete Organization
      • GET Configuration By Client Id
      • GET Configuration By Custom Domain
  1. Attack Protection

Log Events

Introduction
Security monitoring and incident response rely heavily on the analysis of log events. SSOJet generates comprehensive log events to provide detailed information about user activity, system events, and potential security incidents. This document provides a thorough overview of SSOJet's log events, their importance, and best practices for managing them.
Scope
This document covers the following aspects of log events in SSOJet:
Types of log events generated by SSOJet
Importance of log events for security
Best practices for log event management
Retention and disposal of log data
Types of Log Events Generated by SSOJet
SSOJet generates various log events categorized by their function and source:
1.
Authentication Events:
Login attempts (successful and failed)
User logouts
Multi-factor authentication (MFA) attempts
Password reset requests
2.
Authorization Events:
User access attempts to resources and applications
Permission changes and access granted/denied events
3.
Session Events:
Session creation and termination
User activity within a session
4.
Administrative Events:
Configuration changes
User account creation, modification, and deletion
Security policy updates
5.
System Events:
Application restarts and shutdowns
Integration events with other systems
Error messages and warnings
Importance of Log Events for Security
Log events play a vital role in maintaining a secure SSO environment:
Security Monitoring: Analyzing log events helps identify suspicious activity, potential security breaches, and unauthorized access attempts.
Incident Response: In the event of a security incident, log events provide a detailed audit trail to investigate the root cause and scope of the breach.
Compliance Auditing: Log events can be used to demonstrate compliance with security regulations and industry standards.
User Activity Tracking: Monitoring user activity through log events can help identify unusual behavior or potential insider threats.
Best Practices for Log Event Management
Effective log event management is crucial for maximizing their security value:
1.
Centralized Logging: Collect and store log events from all SSOJet components in a central location for easy access and analysis.
2.
Standardization: Use a standardized log format, such as syslog or CEF, to facilitate parsing and analysis across different security tools.
3.
Log Filtering and Correlation: Implement log filtering to focus on relevant events and utilize SIEM (Security Information and Event Management) tools to correlate events from various sources for deeper insights.
4.
Alerting and Notification: Configure alerts and notifications for critical events, such as failed login attempts exceeding a threshold or suspicious user activity.
5.
Log Retention and Disposal: Establish a log retention policy that adheres to legal and compliance requirements while ensuring timely disposal of old data.
Retention and Disposal of Log Data
Log data retention policies should balance security needs with data privacy considerations:
Compliance Requirements: Retain logs for the period mandated by relevant regulations or industry standards.
Security Investigations: Retain logs for a sufficient time to facilitate potential security investigations.
Data Privacy: Develop a secure disposal process to erase outdated log data in accordance with privacy regulations.
Conclusion
Log events are essential for maintaining a secure SSO environment. By understanding the types of logs generated by SSOJet, their importance for security, and best practices for managing them, organizations can leverage log data to effectively monitor user activity, detect threats, respond to incidents, and ensure compliance.
For any security-related inquiries or to report a security incident, please contact our security team at:
Email: support@ssojet.com
This document provides a foundational understanding of log events in SSOJet. Organizations can further customize this document to include specific details about their SSOJet deployment, security policies, and log management tools.
Previous
Brute Force Protection
Next
Secure JSON Web Tokens (JWT)
Built with