File contents Security Event Taxonomy
This document defines the categories of security-relevant events to monitor through instrumentation.
Authentication Events
Event Types:
Login attempts (success/failure)
Logout events
Password changes
Password reset requests
Multi-factor authentication (MFA) challenges
Session creation/destruction
Token generation/validation
Key Data Points:
User identifier (username, email, user ID)
Timestamp
Source IP address
User agent
Authentication method (password, OAuth, SSO, etc.)
Success/failure status
Failure reason (invalid credentials, account locked, etc.)
Authorization Events
Event Types:
Access control decisions (allow/deny)
Permission checks
Role-based access control (RBAC) evaluations
Resource access attempts
Privilege escalation attempts
API endpoint access
Key Data Points:
User identifier
Resource being accessed
Action/operation attempted
Authorization decision (granted/denied)
Timestamp
Required permissions
User's current permissions/roles
Input Validation Events
Event Types:
Validation failures
Sanitization operations
Type coercion failures
Format violations
Boundary violations (length, range)
Injection attempt detection (SQL, XSS, command injection)
Key Data Points:
Input field/parameter name
Validation rule violated
Input value (sanitized/truncated if sensitive)
Expected format/type
Timestamp
Source (form, API, query parameter)
Session Management Events
Event Types:
Session creation
Session expiration
Session invalidation
Session fixation attempts
Concurrent session detection
Session hijacking detection
Key Data Points:
Session ID (hashed or truncated)
User identifier
Session lifetime
Timestamp
IP address changes
User agent changes
Sensitive Data Access
Event Types:
PII access
Financial data access
Health records access
Encryption key usage
Secrets/credentials access
Key Data Points:
Data type accessed
User identifier
Timestamp
Purpose/context
Data volume
Security Configuration Changes
Event Types:
Permission changes
Role assignments
Security policy updates
Firewall rule changes
Encryption settings changes
Key Data Points:
Configuration changed
Old value
New value
User who made change
Timestamp
Justification/reason
1 --- 2 name: 2573-security-events-e42caca5 3 description: Security Event Taxonomy 4 --- 5 # Security Event Taxonomy 6 7 This document defines the categories of security-relevant events to monitor through instrumentation. 8 9 ## Authentication Events 10 11 **Event Types:** 12 - Login attempts (success/failure) 13 - Logout events 14 - Password changes 15 - Password reset requests 16 - Multi-factor authentication (MFA) challenges 17 - Session creation/destruction 18 - Token generation/validation 19 20 **Key Data Points:** 21 - User identifier (username, email, user ID) 22 - Timestamp 23 - Source IP address 24 - User agent 25 - Authentication method (password, OAuth, SSO, etc.) 26 - Success/failure status 27 - Failure reason (invalid credentials, account locked, etc.) 28 29 ## Authorization Events 30 31 **Event Types:** 32 - Access control decisions (allow/deny) 33 - Permission checks 34 - Role-based access control (RBAC) evaluations 35 - Resource access attempts 36 - Privilege escalation attempts 37 - API endpoint access 38 39 **Key Data Points:** 40 - User identifier 41 - Resource being accessed 42 - Action/operation attempted 43 - Authorization decision (granted/denied) 44 - Timestamp 45 - Required permissions 46 - User's current permissions/roles 47 48 ## Input Validation Events 49 50 **Event Types:** 51 - Validation failures 52 - Sanitization operations 53 - Type coercion failures 54 - Format violations 55 - Boundary violations (length, range) 56 - Injection attempt detection (SQL, XSS, command injection) 57 58 **Key Data Points:** 59 - Input field/parameter name 60 - Validation rule violated 61 - Input value (sanitized/truncated if sensitive) 62 - Expected format/type 63 - Timestamp 64 - Source (form, API, query parameter) 65 66 ## Session Management Events 67 68 **Event Types:** 69 - Session creation 70 - Session expiration 71 - Session invalidation 72 - Session fixation attempts 73 - Concurrent session detection 74 - Session hijacking detection 75 76 **Key Data Points:** 77 - Session ID (hashed or truncated) 78 - User identifier 79 - Session lifetime 80 - Timestamp 81 - IP address changes 82 - User agent changes 83 84 ## Sensitive Data Access 85 86 **Event Types:** 87 - PII access 88 - Financial data access 89 - Health records access 90 - Encryption key usage 91 - Secrets/credentials access 92 93 **Key Data Points:** 94 - Data type accessed 95 - User identifier 96 - Timestamp 97 - Purpose/context 98 - Data volume 99 100 ## Security Configuration Changes 101 102 **Event Types:** 103 - Permission changes 104 - Role assignments 105 - Security policy updates 106 - Firewall rule changes 107 - Encryption settings changes 108 109 **Key Data Points:** 110 - Configuration changed 111 - Old value 112 - New value 113 - User who made change 114 - Timestamp 115 - Justification/reason
commit 0ac1e20854
Frequently asked questions How do I install the 2573 Security Events E42caca5 skill? Run npx skillmds@latest add tools-only/2573-security-events-e42caca5 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
What does the 2573 Security Events E42caca5 skill do? Security Event Taxonomy It is listed under Security on SkillMD.
Is 2573 Security Events E42caca5 safe to use? This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
Which AI agents work with 2573 Security Events E42caca5? This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Is 2573 Security Events E42caca5 free to use? Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
Who published 2573 Security Events E42caca5? tools-only (@tools-only) published this skill. Their other Agent Skills are listed on their SkillMD profile.
tools-only