Security Logs Module Documentation

Module Overview (Technical)
Module Overview (Commercial/Business)
Module Overview (End User/Administrator)
Security Event Reference
Common Scenarios & Examples
Limitations & Important Notes
Troubleshooting Tips
Glossary

---

1. Module Overview (Technical)

What Are Security Logs?

Security Logs is a security monitoring module that tracks authentication and access control events. Unlike general Audit Logs, Security Logs focuses specifically on security-relevant events: logins, logout, failed login attempts, password changes, MFA configuration, and permission modifications.

Architecture

Plaintext

┌─────────────────────────────────────────────────────────────────┐
│                 Security Logs Architecture                      │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Security Events                                                │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │        Authentication System                             │   │
│  │                                                          │   │
│  │  ├─ User logs in → LOGIN                                │   │
│  │  ├─ Wrong password → LOGIN_FAILED                       │   │
│  │  ├─ User logs out → LOGOUT                              │   │
│  │  ├─ Password changed → PASSWORD_CHANGE                   │   │
│  │  ├─ Password reset → PASSWORD_RESET                      │   │
│  │  ├─ MFA enabled → MFA_ENABLED                           │   │
│  │  ├─ MFA disabled → MFA_DISABLED                         │   │
│  │  └─ Role/permission change → PERMISSION_CHANGE           │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│       │                                                         │
│       ▼ Logged with context                                    │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │        public.security_logs                              │   │
│  │                                                          │   │
│  │  | event | user | ip_address | user_agent | timestamp | │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│       │                                                         │
│       ▼ Displayed in Viewer                                     │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │        Security Logs Page                                │   │
│  │                                                          │   │
│  │  ┌─────────────────────────────────────────────────────┐ │   │
│  │  │Time   │Event       │User  │IP Address │Details    │ │   │
│  │  ├───────┼────────────┼──────┼───────────┼───────────┤ │   │
│  │  │10:30  │Login       │admin │192.168.1.1│ [👁️]      │ │   │
│  │  │10:28  │Login Failed│john  │10.0.0.5   │ [👁️]      │ │   │
│  │  │10:25  │MFA Enabled │admin │192.168.1.1│ [👁️]      │ │   │
│  │  └─────────────────────────────────────────────────────┘ │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Key Tables

Table	Purpose
`public.security_logs`	Security event records

Key Files

File	Description
`modules/securityLogs/`	Frontend module
`modules/securityLogs/api/securityLogApi.ts`	API calls
`modules/securityLogs/types/securityLog.types.ts`	Type definitions

---

2. Module Overview (Commercial/Business)

Business Value

Security Logs provides security visibility:

Without Security Logs	With Security Logs
Unknown access	Login tracking
Hidden attacks	Failed login alerts
No MFA tracking	MFA event history
Permission blind	Permission change log

Use Cases

Intrusion Detection

- Track failed logins

- Identify brute force attacks

Access Auditing

- View login history

- Track session patterns

Compliance

- SOC 2 requirements

- Security audit trail

Incident Response

- Investigate breaches

- Forensic analysis

Feature Highlights

Feature	Benefit
Login Tracking	Who accessed system
Failed Logins	Attack detection
Password Events	Credential changes
MFA Events	2FA configuration
Permission Changes	Access control audit
IP Tracking	Location awareness

---

3. Module Overview (End User/Administrator)

What Can You Do?

View all security events
Track login/logout activity
Monitor failed login attempts
Review password changes
Track MFA configuration
Monitor permission changes
Filter by event type and user

Security Logs Interface

Plaintext

┌─────────────────────────────────────────────────────────────────┐
│              Security Logs                                      │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Filters:                                                       │
│  ├─ Range: [7 Days ▼]                                          │
│  ├─ Event Type: [All Events ▼]                                 │
│  ├─ User: [All Users ▼]                                        │
│  └─ [🔄 Refresh] [Clear Filters]                               │
│                                                                 │
│  🔍 [Search by action, user, or IP address...            ]     │
│                                                                 │
│  ┌───────────────────────────────────────────────────────────┐  │
│  │ Timestamp    │ Event          │ User   │ IP Address  │👁️│  │
│  ├──────────────┼────────────────┼────────┼─────────────┼──┤  │
│  │ 01/16 10:30  │ 🟢 Login       │ admin  │ 192.168.1.1 │👁️│  │
│  │ 01/16 10:28  │ 🔴 Login Failed│ john   │ 10.0.0.5    │👁️│  │
│  │ 01/16 10:27  │ 🔴 Login Failed│ john   │ 10.0.0.5    │👁️│  │
│  │ 01/16 10:26  │ 🔴 Login Failed│ john   │ 10.0.0.5    │👁️│  │
│  │ 01/16 10:00  │ 🔒 MFA Enabled │ admin  │ 192.168.1.1 │👁️│  │
│  │ 01/15 18:30  │ 🚪 Logout      │ admin  │ 192.168.1.1 │👁️│  │
│  │ 01/15 17:00  │ 🔑 Pass Change │ jane   │ 192.168.1.2 │👁️│  │
│  └───────────────────────────────────────────────────────────┘  │
│                                                                 │
│  ⚠️ Alert: 3 failed login attempts for 'john' in last hour     │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Quick Tips

TIP

Failed Logins: Multiple failed attempts may indicate an attack.

TIP

Unusual IPs: Watch for logins from unexpected locations.

CAUTION

MFA Disabled: Review any MFA disable events immediately.

---

4. Security Event Reference

Event Types

Event	Icon	Description
Login	🟢	Successful authentication
Logout	🚪	User session ended
Login Failed	🔴	Failed authentication attempt
Password Change	🔑	User changed password
Password Reset	🔄	Password was reset
MFA Enabled	🔒	Two-factor authentication enabled
MFA Disabled	🔓	Two-factor authentication disabled
Permission Change	👥	User role/permissions modified

Event Details

Field	Description
Timestamp	When event occurred
User	Affected user account
IP Address	Source IP address
User Agent	Browser/client info
Resource	Related resource type
Metadata	Additional context

Severity Levels

Event	Severity	Action Needed
Login	Info	Normal activity
Logout	Info	Normal activity
Login Failed	Warning	Monitor for patterns
Password Change	Info	Expected activity
Password Reset	Medium	Verify authorization
MFA Enabled	Info	Security improvement
MFA Disabled	High	Investigate immediately
Permission Change	Medium	Verify authorization

---

5. Common Scenarios & Examples

Scenario 1: Detect Brute Force Attack

Filter by "Login Failed"
Look for same user/IP with multiple failures
Check timestamp clustering
Block IP if attack confirmed

Set date range for period
Filter by specific user
Review all login events
Check for unusual IPs

Scenario 3: Investigate MFA Change

Filter by "MFA Disabled"
Identify who disabled MFA
Check if authorized
Re-enable if needed

Scenario 4: Permission Audit

Filter by "Permission Change"
Review who made changes
Verify proper authorization
Document for compliance

---

6. Limitations & Important Notes

Technical Notes

NOTE

Security Focus: Only security events, not data changes.

NOTE

Real-time: Events logged immediately.

WARNING

Failed Logins: May contain attempted usernames (could be typos).

Best Practices

Daily Review: Check failed logins daily
Alert Setup: Configure alerts for patterns
IP Monitoring: Watch for unusual locations
MFA Enforcement: Monitor MFA disable events
Permission Reviews: Audit permission changes regularly

Common Attack Patterns

Pattern	Indicator	Response
Brute Force	Many failures, same user	Lock account, block IP
Credential Stuffing	Many users, same IP	Block IP range
Insider Threat	Off-hours access	Investigate user
Account Takeover	Password changed + MFA disabled	Lock account immediately

---

7. Troubleshooting Tips

Common Issues

Symptom	Possible Cause	Solution
No records	Too restrictive filter	Clear filters
Missing logins	Events not logged	Check logging configuration
Unknown IP	VPN or proxy	Check user's network
Many failures	Attack or typos	Investigate pattern
Slow loading	Large date range	Reduce date range

Diagnostic SQL

Recent security events:

Sql

SELECT 
  timestamp,
  event,
  user_email,
  ip_address,
  user_agent
FROM public.security_logs
ORDER BY timestamp DESC
LIMIT 50;

Failed login summary:

Sql

SELECT 
  user_email,
  ip_address,
  COUNT(*) as failed_attempts
FROM public.security_logs
WHERE event = 'LOGIN_FAILED'
  AND timestamp >= NOW() - INTERVAL '24 hours'
GROUP BY user_email, ip_address
ORDER BY failed_attempts DESC;

Login locations:

Sql

SELECT 
  user_email,
  ip_address,
  COUNT(*) as logins,
  MAX(timestamp) as last_login
FROM public.security_logs
WHERE event = 'LOGIN'
GROUP BY user_email, ip_address
ORDER BY last_login DESC;

---

8. Glossary

Term	Definition
MFA	Multi-Factor Authentication
Brute Force	Repeated login attempts
Credential Stuffing	Testing stolen credentials
Session	Authenticated user period
User Agent	Browser/client identification
Failed Login	Incorrect credentials

---

Lua Script Status ℹ️

No Lua Handler Required

Component	Status
Security Logs	ℹ️ Backend-logged - recorded by authentication system

Security Logs is a frontend reporting module. Security events are logged automatically by the backend authentication middleware. No Lua handlers are used.

---

Documentation last updated: January 2026