Security Logging and Alerting Failures
Attacks succeed undetected because the application does not log enough, or no alert is raised when something is logged.
What it is
Security Logging and Alerting Failures retains A09 in 2025, with a name change from 'Logging and Monitoring' to emphasize the alerting function needed to induce action on relevant logging events. The category covers gaps in the observability stack that let an attack progress undetected: missing logs on auth events, logs that are written but never reviewed, log storage that the attacker can also reach, log formats that lose attribution detail (no user ID, no source IP), and detection rules that exist but are not tuned. OWASP relevant CWEs include CWE-117 (Improper Output Encoding for Logs), CWE-532 (Inserting Sensitive Data into Log Files), and CWE-778 (Insufficient Logging).
Common patterns
- •Authentication and authorization decisions logged at INFO without source IP, user ID, or correlation ID.
- •Failed login attempts not logged at all, or logged without enough metadata to detect credential stuffing.
- •Privilege changes, role assignments, or permission grants not audit-logged.
- •Application logs stored in the same blast radius as the application (attacker who compromises the app also tampers with the logs).
- •Log retention shorter than the typical breach dwell time.
- •Alerts wired to channels (email, low-priority Slack) that are not acted on.
What Deva detects
Deva includes a configurable rule pack that flags state-changing operations (privilege changes, financial transactions, permission grants, data exports) where no audit-log write is present in the same function. The rule is intentionally tunable: not every state change needs an audit log, but most regulated operations do. The compliance frameworks for HIPAA, PCI-DSS, and SOX all impose specific logging requirements that this rule pack maps to.
Real-world examples
| Year | Incident | What happened |
|---|---|---|
| 2013 | Target (40M payment cards) | The intrusion was detected by Target's FireEye sensors and reported into a malware management console. The alerts were not acted on for two weeks while attackers exfiltrated payment data. The technical detection succeeded; the operational response failed. |
| 2023 | MOVEit Transfer (CL0P campaign) | CL0P exploited a zero-day in MOVEit Transfer (CVE-2023-34362) and exfiltrated data from hundreds of organizations. Many victims discovered the breach weeks later via extortion notices because logging in MOVEit did not surface the anomalous SQL injection patterns the campaign used. |
Compliance framework impact
- •NIST 800-53 AU-2 Event Logging, AU-12 Audit Record Generation
- •PCI-DSS v4.0 Req 10 Logging and monitoring
- •HIPAA 164.312(b) Audit Controls
- •SOX Section 404 (audit trail integrity)
- •CMMC 2.0 AU.L2-3.3.1 Audit logs, AU.L2-3.3.5 Audit correlation
Deva detects the security logging and alerting failures patterns above at write time, alongside 970+ other CWE rules, with fixes mapped to the compliance controls each finding touches.