Cursor rule

1---
2description: Detect and prevent security logging and monitoring failures in JavaScript applications as defined in OWASP Top 10:2021-A09
3globs: **/*.js, **/*.jsx, **/*.ts, **/*.tsx, !**/node_modules/**, !**/dist/**, !**/build/**, !**/coverage/**
4---
5# JavaScript Security Logging and Monitoring Failures (OWASP A09:2021)
6 
7<rule>
8name: javascript_security_logging_monitoring_failures
9description: Detect and prevent security logging and monitoring failures in JavaScript applications as defined in OWASP Top 10:2021-A09
10 
11actions:
12  - type: enforce
13    conditions:
14      # Pattern 1: Missing Error Logging
15      - pattern: "(?:try\\s*{[^}]*}\\s*catch\\s*\\([^)]*\\)\\s*{[^}]*})(?![^;{]*(?:console\\.(?:error|warn|log)|logger?\\.(?:error|warn|log)|captureException))"
16        message: "Error caught without proper logging. Implement structured error logging for security events."
17        
18      # Pattern 2: Sensitive Data in Logs
19      - pattern: "console\\.(?:log|warn|error|info|debug)\\s*\\([^)]*(?:password|token|secret|key|credential|auth|jwt|session|cookie)"
20        negative_pattern: "\\*\\*\\*|redact|mask|sanitize"
21        message: "Potential sensitive data in logs. Ensure sensitive information is redacted before logging."
22        
23      # Pattern 3: Missing Authentication Logging
24      - pattern: "(?:login|signin|authenticate|auth)\\s*\\([^)]*\\)\\s*{[^}]*}"
25        negative_pattern: "(?:log|audit|record|track)\\s*\\("
26        message: "Authentication function without logging. Log authentication attempts, successes, and failures."
27        
28      # Pattern 4: Missing Authorization Logging
29      - pattern: "(?:authorize|checkPermission|hasAccess|isAuthorized|can)\\s*\\([^)]*\\)\\s*{[^}]*}"
30        negative_pattern: "(?:log|audit|record|track)\\s*\\("
31        message: "Authorization check without logging. Log access control decisions, especially denials."
32        
33      # Pattern 5: Insufficient Error Detail
34      - pattern: "(?:console\\.error|logger?\\.error)\\s*\\([^)]*(?:error|err|exception)\\s*\\)"
35        negative_pattern: "(?:error\\.(?:message|stack|code|name)|JSON\\.stringify\\(error\\)|serialize)"
36        message: "Error logging with insufficient detail. Include error type, message, stack trace, and context."
37        
38      # Pattern 6: Missing Security Event Logging
39      - pattern: "(?:bruteForce|rateLimit|block|blacklist|suspicious|anomaly|threat|attack|intrusion|malicious)"
40        negative_pattern: "(?:log|audit|record|track|monitor|alert|notify)"
41        message: "Security event detection without logging. Implement logging for all security-relevant events."
42        
43      # Pattern 7: Inconsistent Log Formats
44      - pattern: "console\\.(?:log|warn|error|info|debug)\\s*\\("
45        negative_pattern: "JSON\\.stringify|structured|format"
46        message: "Inconsistent log format. Use structured logging with consistent formats for easier analysis."
47        
48      # Pattern 8: Missing Log Correlation ID
49      - pattern: "(?:api|http|fetch|axios|request)\\s*\\([^)]*\\)"
50        negative_pattern: "(?:correlationId|requestId|traceId|spanId|context)"
51        message: "API request without correlation ID. Include correlation IDs in logs for request tracing."
52        
53      # Pattern 9: Missing High-Value Transaction Logging
54      - pattern: "(?:payment|transaction|order|purchase|transfer|withdraw|deposit)\\s*\\([^)]*\\)"
55        negative_pattern: "(?:log|audit|record|track)"
56        message: "High-value transaction without audit logging. Implement comprehensive logging for all transactions."
57        
58      # Pattern 10: Client-Side Logging Issues
59      - pattern: "(?:window\\.onerror|window\\.addEventListener\\s*\\(\\s*['\"]error['\"])"
60        negative_pattern: "(?:send|report|log|capture|track)"
61        message: "Client-side error handler without reporting. Implement error reporting to backend services."
62        
63      # Pattern 11: Missing Log Levels
64      - pattern: "console\\.log\\s*\\("
65        negative_pattern: "logger?\\.(?:error|warn|info|debug|trace)"
66        message: "Using console.log without proper log levels. Implement a logging library with appropriate log levels."
67        
68      # Pattern 12: Missing Monitoring Integration
69      - pattern: "package\\.json"
70        negative_pattern: "(?:sentry|newrelic|datadog|appinsights|loggly|splunk|elasticsearch|winston|bunyan|pino|loglevel)"
71        file_pattern: "package\\.json$"
72        message: "No logging or monitoring dependencies detected. Consider adding a proper logging library and monitoring integration."
73        
74      # Pattern 13: Missing Log Aggregation
75      - pattern: "(?:docker-compose\\.ya?ml|\\.env|\\.env\\.example|Dockerfile)"
76        negative_pattern: "(?:sentry|newrelic|datadog|appinsights|loggly|splunk|elasticsearch|logstash|fluentd|kibana)"
77        file_pattern: "(?:docker-compose\\.ya?ml|\\.env|\\.env\\.example|Dockerfile)$"
78        message: "No log aggregation service configured. Implement centralized log collection and analysis."
79        
80      # Pattern 14: Missing Health Checks
81      - pattern: "(?:express|koa|fastify|hapi|http\\.createServer)"
82        negative_pattern: "(?:health|status|heartbeat|alive|ready)"
83        message: "Server without health check endpoint. Implement health checks for monitoring service status."
84        
85      # Pattern 15: Missing Rate Limiting Logs
86      - pattern: "(?:rateLimit|throttle|limiter)"
87        negative_pattern: "(?:log|record|track|monitor|alert|notify)"
88        message: "Rate limiting without logging. Log rate limit events to detect potential attacks."
89 
90  - type: suggest
91    message: |
92      **JavaScript Security Logging and Monitoring Best Practices:**
93      
94      1. **Structured Error Logging:**
95         - Use structured logging formats (JSON)
96         - Include contextual information with errors
97         - Example:
98```javascript
99           try {
100             // Operation that might fail
101             processUserData(userData);
102           } catch (error) {
103             logger.error({
104               message: 'Failed to process user data',
105               error: {
106                 name: error.name,
107                 message: error.message,
108                 stack: error.stack
109               },
110               userId: userData.id,
111               context: 'user-processing',
112               timestamp: new Date().toISOString()
113             });
114             // Handle the error appropriately
115           }
116```
117      
118      2. **Sensitive Data Redaction:**
119         - Redact sensitive information before logging
120         - Use dedicated functions for sanitization
121         - Example:
122```javascript
123           function redactSensitiveData(obj) {
124             const sensitiveFields = ['password', 'token', 'secret', 'creditCard', 'ssn'];
125             const redacted = { ...obj };
126             
127             for (const field of sensitiveFields) {
128               if (field in redacted) {
129                 redacted[field] = '***REDACTED***';
130               }
131             }
132             
133             return redacted;
134           }
135           
136           // Usage
137           logger.info({
138             message: 'User login attempt',
139             user: redactSensitiveData(userData),
140             timestamp: new Date().toISOString()
141           });
142```
143      
144      3. **Authentication Logging:**
145         - Log all authentication events
146         - Include success/failure status
147         - Example:
148```javascript
149           async function authenticateUser(username, password) {
150             try {
151               const user = await User.findOne({ username });
152               
153               if (!user) {
154                 logger.warn({
155                   message: 'Authentication failed: user not found',
156                   username,
157                   ipAddress: req.ip,
158                   userAgent: req.headers['user-agent'],
159                   timestamp: new Date().toISOString()
160                 });
161                 return { success: false, reason: 'invalid_credentials' };
162               }
163               
164               const isValid = await bcrypt.compare(password, user.passwordHash);
165               
166               if (!isValid) {
167                 logger.warn({
168                   message: 'Authentication failed: invalid password',
169                   username,
170                   userId: user.id,
171                   ipAddress: req.ip,
172                   userAgent: req.headers['user-agent'],
173                   timestamp: new Date().toISOString()
174                 });
175                 return { success: false, reason: 'invalid_credentials' };
176               }
177               
178               logger.info({
179                 message: 'User authenticated successfully',
180                 username,
181                 userId: user.id,
182                 ipAddress: req.ip,
183                 userAgent: req.headers['user-agent'],
184                 timestamp: new Date().toISOString()
185               });
186               
187               return { success: true, user };
188             } catch (error) {
189               logger.error({
190                 message: 'Authentication error',
191                 username,
192                 error: {
193                   name: error.name,
194                   message: error.message,
195                   stack: error.stack
196                 },
197                 timestamp: new Date().toISOString()
198               });
199               return { success: false, reason: 'system_error' };
200             }
201           }
202```
203      
204      4. **Authorization Logging:**
205         - Log access control decisions
206         - Include user, resource, and action
207         - Example:
208```javascript
209           function checkPermission(user, resource, action) {
210             const hasPermission = user.permissions.some(p => 
211               p.resource === resource && p.actions.includes(action)
212             );
213             
214             logger.info({
215               message: `Authorization ${hasPermission ? 'granted' : 'denied'}`,
216               userId: user.id,
217               username: user.username,
218               resource,
219               action,
220               decision: hasPermission ? 'allow' : 'deny',
221               timestamp: new Date().toISOString()
222             });
223             
224             return hasPermission;
225           }
226```
227      
228      5. **Comprehensive Error Logging:**
229         - Include detailed error information
230         - Add context for troubleshooting
231         - Example:
232```javascript
233           // Using a logging library like Winston
234           const winston = require('winston');
235           
236           const logger = winston.createLogger({
237             level: process.env.LOG_LEVEL || 'info',
238             format: winston.format.combine(
239               winston.format.timestamp(),
240               winston.format.json()
241             ),
242             defaultMeta: { service: 'user-service' },
243             transports: [
244               new winston.transports.Console(),
245               new winston.transports.File({ filename: 'error.log', level: 'error' }),
246               new winston.transports.File({ filename: 'combined.log' })
247             ]
248           });
249           
250           // Usage
251           try {
252             // Operation that might fail
253           } catch (error) {
254             logger.error({
255               message: 'Operation failed',
256               operationName: 'processData',
257               error: {
258                 name: error.name,
259                 message: error.message,
260                 code: error.code,
261                 stack: error.stack
262               },
263               context: {
264                 userId: req.user?.id,
265                 requestId: req.id,
266                 path: req.path,
267                 method: req.method
268               }
269             });
270           }
271```
272      
273      6. **Security Event Logging:**
274         - Log all security-relevant events
275         - Include detailed context
276         - Example:
277```javascript
278           function detectBruteForce(username, ipAddress) {
279             const attempts = getLoginAttempts(username, ipAddress);
280             
281             if (attempts > MAX_ATTEMPTS) {
282               logger.warn({
283                 message: 'Possible brute force attack detected',
284                 username,
285                 ipAddress,
286                 attempts,
287                 threshold: MAX_ATTEMPTS,
288                 action: 'account_temporarily_locked',
289                 timestamp: new Date().toISOString()
290               });
291               
292               // Implement account lockout or IP blocking
293               lockAccount(username, LOCKOUT_DURATION);
294               return true;
295             }
296             
297             return false;
298           }
299```
300      
301      7. **Structured Logging Format:**
302         - Use JSON for machine-readable logs
303         - Maintain consistent field names
304         - Example:
305```javascript
306           // Using a structured logging library like Pino
307           const pino = require('pino');
308           
309           const logger = pino({
310             level: process.env.LOG_LEVEL || 'info',
311             base: { pid: process.pid, hostname: os.hostname() },
312             timestamp: pino.stdTimeFunctions.isoTime,
313             formatters: {
314               level: (label) => {
315                 return { level: label };
316               }
317             }
318           });
319           
320           // Usage
321           logger.info({
322             msg: 'User profile updated',
323             userId: user.id,
324             changes: ['email', 'preferences'],
325             source: 'api'
326           });
327```
328      
329      8. **Request Correlation:**
330         - Use correlation IDs across services
331         - Track request flow through the system
332         - Example:
333```javascript
334           // Express middleware for adding correlation IDs
335           const { v4: uuidv4 } = require('uuid');
336           
337           function correlationMiddleware(req, res, next) {
338             // Use existing correlation ID from headers or generate a new one
339             const correlationId = req.headers['x-correlation-id'] || uuidv4();
340             req.correlationId = correlationId;
341             
342             // Add to response headers
343             res.setHeader('x-correlation-id', correlationId);
344             
345             // Add to logger context for this request
346             req.logger = logger.child({ correlationId });
347             
348             next();
349           }
350           
351           // Usage in route handlers
352           app.get('/api/users/:id', (req, res) => {
353             req.logger.info({
354               msg: 'User profile requested',
355               userId: req.params.id,
356               path: req.path,
357               method: req.method
358             });
359             
360             // Process request...
361           });
362```
363      
364      9. **Transaction Logging:**
365         - Log all high-value transactions
366         - Include before/after states
367         - Example:
368```javascript
369           async function processPayment(userId, amount, paymentMethod) {
370             logger.info({
371               message: 'Payment processing started',
372               userId,
373               amount,
374               paymentMethod: {
375                 type: paymentMethod.type,
376                 lastFour: paymentMethod.lastFour
377               },
378               transactionId: generateTransactionId(),
379               timestamp: new Date().toISOString()
380             });
381             
382             try {
383               const result = await paymentGateway.charge({
384                 amount,
385                 source: paymentMethod.token
386               });
387               
388               logger.info({
389                 message: 'Payment processed successfully',
390                 userId,
391                 amount,
392                 transactionId: result.transactionId,
393                 gatewayReference: result.reference,
394                 status: 'success',
395                 timestamp: new Date().toISOString()
396               });
397               
398               return { success: true, transactionId: result.transactionId };
399             } catch (error) {
400               logger.error({
401                 message: 'Payment processing failed',
402                 userId,
403                 amount,
404                 error: {
405                   name: error.name,
406                   message: error.message,
407                   code: error.code
408                 },
409                 status: 'failed',
410                 timestamp: new Date().toISOString()
411               });
412               
413               return { success: false, error: error.message };
414             }
415           }
416```
417      
418      10. **Client-Side Error Reporting:**
419          - Send client errors to the backend
420          - Include browser and user context
421          - Example:
422```javascript
423            // Client-side error tracking
424            window.addEventListener('error', function(event) {
425              const errorDetails = {
426                message: event.message,
427                source: event.filename,
428                lineno: event.lineno,
429                colno: event.colno,
430                error: {
431                  stack: event.error?.stack
432                },
433                url: window.location.href,
434                userAgent: navigator.userAgent,
435                timestamp: new Date().toISOString(),
436                // Add user context if available
437                userId: window.currentUser?.id
438              };
439              
440              // Send to backend logging endpoint
441              fetch('/api/log/client-error', {
442                method: 'POST',
443                headers: {
444                  'Content-Type': 'application/json'
445                },
446                body: JSON.stringify(errorDetails),
447                // Use keepalive to ensure the request completes even if the page is unloading
448                keepalive: true
449              }).catch(err => {
450                // Fallback if the logging endpoint fails
451                console.error('Failed to send error report:', err);
452              });
453            });
454```
455      
456      11. **Proper Log Levels:**
457          - Use appropriate log levels
458          - Configure based on environment
459          - Example:
460```javascript
461            // Using Winston with proper log levels
462            const winston = require('winston');
463            
464            const logger = winston.createLogger({
465              level: process.env.NODE_ENV === 'production' ? 'info' : 'debug',
466              levels: winston.config.npm.levels,
467              format: winston.format.combine(
468                winston.format.timestamp(),
469                winston.format.json()
470              ),
471              transports: [
472                new winston.transports.Console({
473                  format: winston.format.combine(
474                    winston.format.colorize(),
475                    winston.format.simple()
476                  )
477                })
478              ]
479            });
480            
481            // Usage with appropriate levels
482            logger.error('Critical application error'); // Always logged
483            logger.warn('Potential issue detected'); // Warning conditions
484            logger.info('Normal operational message'); // Normal but significant
485            logger.http('HTTP request received'); // HTTP request logging
486            logger.verbose('Detailed information'); // Detailed debug information
487            logger.debug('Debugging information'); // For developers
488            logger.silly('Extremely detailed tracing'); // Most granular
489```
490      
491      12. **Monitoring Integration:**
492          - Integrate with monitoring services
493          - Set up alerts for critical issues
494          - Example:
495```javascript
496            // Using Sentry for error monitoring
497            const Sentry = require('@sentry/node');
498            const Tracing = require('@sentry/tracing');
499            const express = require('express');
500            
501            const app = express();
502            
503            Sentry.init({
504              dsn: process.env.SENTRY_DSN,
505              integrations: [
506                new Sentry.Integrations.Http({ tracing: true }),
507                new Tracing.Integrations.Express({ app })
508              ],
509              tracesSampleRate: 1.0
510            });
511            
512            // Use Sentry middleware
513            app.use(Sentry.Handlers.requestHandler());
514            app.use(Sentry.Handlers.tracingHandler());
515            
516            // Your routes here
517            
518            // Error handler
519            app.use(Sentry.Handlers.errorHandler());
520            app.use((err, req, res, next) => {
521              // Custom error handling
522              logger.error({
523                message: 'Express error',
524                error: {
525                  name: err.name,
526                  message: err.message,
527                  stack: err.stack
528                },
529                request: {
530                  path: req.path,
531                  method: req.method,
532                  correlationId: req.correlationId
533                }
534              });
535              
536              res.status(500).json({ error: 'Internal server error' });
537            });
538```
539      
540      13. **Log Aggregation:**
541          - Set up centralized log collection
542          - Configure log shipping
543          - Example:
544```javascript
545            // Using Winston with Elasticsearch transport
546            const winston = require('winston');
547            const { ElasticsearchTransport } = require('winston-elasticsearch');
548            
549            const esTransportOpts = {
550              level: 'info',
551              clientOpts: {
552                node: process.env.ELASTICSEARCH_URL,
553                auth: {
554                  username: process.env.ELASTICSEARCH_USERNAME,
555                  password: process.env.ELASTICSEARCH_PASSWORD
556                }
557              },
558              indexPrefix: 'app-logs'
559            };
560            
561            const logger = winston.createLogger({
562              transports: [
563                new winston.transports.Console(),
564                new ElasticsearchTransport(esTransportOpts)
565              ]
566            });
567```
568            
569```yaml
570            # docker-compose.yml example with ELK stack
571            version: '3'
572            services:
573              app:
574                build: .
575                environment:
576                  - NODE_ENV=production
577                  - ELASTICSEARCH_URL=http://elasticsearch:9200
578                depends_on:
579                  - elasticsearch
580              
581              elasticsearch:
582                image: docker.elastic.co/elasticsearch/elasticsearch:7.14.0
583                environment:
584                  - discovery.type=single-node
585                  - ES_JAVA_OPTS=-Xms512m -Xmx512m
586                volumes:
587                  - es_data:/usr/share/elasticsearch/data
588              
589              kibana:
590                image: docker.elastic.co/kibana/kibana:7.14.0
591                ports:
592                  - "5601:5601"
593                depends_on:
594                  - elasticsearch
595              
596              logstash:
597                image: docker.elastic.co/logstash/logstash:7.14.0
598                volumes:
599                  - ./logstash/pipeline:/usr/share/logstash/pipeline
600                depends_on:
601                  - elasticsearch
602            
603            volumes:
604              es_data:
605```
606      
607      14. **Health Checks and Monitoring:**
608          - Implement health check endpoints
609          - Monitor application status
610          - Example:
611```javascript
612            const express = require('express');
613            const app = express();
614            
615            // Basic health check endpoint
616            app.get('/health', (req, res) => {
617              const status = {
618                status: 'UP',
619                timestamp: new Date().toISOString(),
620                uptime: process.uptime(),
621                memoryUsage: process.memoryUsage(),
622                version: process.env.npm_package_version
623              };
624              
625              // Add database health check
626              try {
627                // Check database connection
628                status.database = { status: 'UP' };
629              } catch (error) {
630                status.database = { status: 'DOWN', error: error.message };
631                status.status = 'DEGRADED';
632              }
633              
634              // Add external service health checks
635              // ...
636              
637              // Log health check results
638              logger.debug({
639                message: 'Health check performed',
640                result: status
641              });
642              
643              const statusCode = status.status === 'UP' ? 200 : 
644                                status.status === 'DEGRADED' ? 200 : 503;
645              
646              res.status(statusCode).json(status);
647            });
648            
649            // Detailed readiness probe
650            app.get('/ready', async (req, res) => {
651              const checks = [];
652              let isReady = true;
653              
654              // Check database
655              try {
656                await db.ping();
657                checks.push({ component: 'database', status: 'ready' });
658              } catch (error) {
659                isReady = false;
660                checks.push({ 
661                  component: 'database', 
662                  status: 'not ready',
663                  error: error.message
664                });
665              }
666              
667              // Check cache
668              try {
669                await cache.ping();
670                checks.push({ component: 'cache', status: 'ready' });
671              } catch (error) {
672                isReady = false;
673                checks.push({ 
674                  component: 'cache', 
675                  status: 'not ready',
676                  error: error.message
677                });
678              }
679              
680              // Log readiness check
681              logger.debug({
682                message: 'Readiness check performed',
683                isReady,
684                checks
685              });
686              
687              res.status(isReady ? 200 : 503).json({
688                status: isReady ? 'ready' : 'not ready',
689                checks,
690                timestamp: new Date().toISOString()
691              });
692            });
693```
694      
695      15. **Rate Limiting with Logging:**
696          - Log rate limit events
697          - Track potential abuse
698          - Example:
699```javascript
700            const rateLimit = require('express-rate-limit');
701            
702            // Create rate limiter with logging
703            const apiLimiter = rateLimit({
704              windowMs: 15 * 60 * 1000, // 15 minutes
705              max: 100, // limit each IP to 100 requests per windowMs
706              standardHeaders: true,
707              legacyHeaders: false,
708              handler: (req, res, next, options) => {
709                // Log rate limit exceeded
710                logger.warn({
711                  message: 'Rate limit exceeded',
712                  ip: req.ip,
713                  path: req.path,
714                  method: req.method,
715                  userAgent: req.headers['user-agent'],
716                  currentLimit: options.max,
717                  windowMs: options.windowMs,
718                  correlationId: req.correlationId,
719                  userId: req.user?.id,
720                  timestamp: new Date().toISOString()
721                });
722                
723                res.status(options.statusCode).json({
724                  status: 'error',
725                  message: options.message
726                });
727              },
728              // Called on all requests to track usage
729              onLimitReached: (req, res, options) => {
730                // This is called when a client hits the rate limit
731                logger.warn({
732                  message: 'Client reached rate limit',
733                  ip: req.ip,
734                  path: req.path,
735                  method: req.method,
736                  userAgent: req.headers['user-agent'],
737                  correlationId: req.correlationId,
738                  userId: req.user?.id,
739                  timestamp: new Date().toISOString()
740                });
741                
742                // Consider additional actions like temporary IP ban
743                // or sending alerts for potential attacks
744              }
745            });
746            
747            // Apply to all API routes
748            app.use('/api/', apiLimiter);
749```
750 
751  - type: validate
752    conditions:
753      # Check 1: Structured Logging
754      - pattern: "(?:winston|pino|bunyan|loglevel|morgan|log4js)"
755        message: "Using a structured logging library."
756      
757      # Check 2: Error Logging
758      - pattern: "try\\s*{[^}]*}\\s*catch\\s*\\([^)]*\\)\\s*{[^}]*(?:logger?\\.error|captureException)\\s*\\([^)]*\\)"
759        message: "Implementing proper error logging in catch blocks."
760      
761      # Check 3: Sensitive Data Handling
762      - pattern: "(?:redact|mask|sanitize|filter)\\s*\\([^)]*(?:password|token|secret|key|credential)"
763        message: "Implementing sensitive data redaction in logs."
764      
765      # Check 4: Correlation IDs
766      - pattern: "(?:correlationId|requestId|traceId)"
767        message: "Using correlation IDs for request tracing."
768      
769      # Check 5: Monitoring Integration
770      - pattern: "(?:sentry|newrelic|datadog|appinsights|loggly|splunk|elasticsearch)"
771        message: "Integrating with monitoring or log aggregation services."
772 
773metadata:
774  priority: high
775  version: 1.0
776  tags:
777    - security
778    - javascript
779    - nodejs
780    - browser
781    - logging
782    - monitoring
783    - owasp
784    - language:javascript
785    - framework:express
786    - framework:react
787    - framework:vue
788    - framework:angular
789    - category:security
790    - subcategory:logging
791    - standard:owasp-top10
792    - risk:a09-security-logging-monitoring-failures
793  references:
794    - "https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/"
795    - "https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"
796    - "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/10-Business_Logic_Testing/08-Test_for_Process_Timing"
797    - "https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Logging_Vocabulary_Cheat_Sheet.md"
798    - "https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html#security-logging-monitoring"
799    - "https://cheatsheetseries.owasp.org/cheatsheets/Application_Logging_Vocabulary_Cheat_Sheet.html"
800    - "https://cheatsheetseries.owasp.org/cheatsheets/Transaction_Authorization_Cheat_Sheet.html#monitor-activity"
801</rule> 
802