Deny-log detection and triage

Objective

Make authorization decisions observable and usable: log enough to reconstruct who tried what, and tune a rule so denials become signal instead of noise.

Prerequisites

• An app that logs authorization outcomes (allowed and denied).
• A way to search or aggregate those logs (a log viewer is enough).
• One low-privilege session you can use to generate denials on purpose.

Environment

• Record schema: timestamp, actor, tenant, object, action, policy decision, reason.
• A rule that fires on repeated denials from one actor across several objects.
• A threshold you can adjust, kept honest against normal user behavior.

Steps

1. 1

   Fix the event schema

   Ensure every decision log line carries actor, tenant, object, and action. Without the object and tenant, a denial cannot be told apart from a cross-tenant attempt.

2. 2

   Generate a denial burst

   From the low-privilege session, attempt a sequence of objects you are not entitled to. This is the pattern a scanning attacker produces.

3. 3

   Tune the rule

   Raise or lower the threshold so the burst fires but routine denials do not. A noisy rule gets muted, which is worse than no rule.

4. 4

   Confirm with one request

   For each alert, take the actor and object and reproduce the single denied request. An alert without a reproducible request is a hypothesis, not a finding.

How to verify

• Each log line reconstructs actor, tenant, object, action, and decision.
• The burst fires the rule; a single normal denial does not.
• Every alert is backed by a reproducible single request.