Assess Log Category Checklist

[btylerburton]

User Story

In order to determine that we are in compliance with GSA IT logging regulations, datagovteam wants to assert that we are logging each of the items in the spreadsheet linked below.

https://docs.google.com/document/d/1Gau0a3JlZrLDyXhvSMa49Lj-ne443fXpJrt9G1L0ckc/edit?usp=sharing

Acceptance Criteria

[ACs should be clearly demoable/verifiable whenever possible. Try specifying them using BDD.]

• GIVEN I have an instance of a data.gov application
  THEN I want to assert that all logs enumerated in the above spreadsheet are being captured

Note: as we do not log anything to static files, we can leave that column alone.

Background

[Any helpful contextual notes or links to artifacts/evidence, if needed]

Security Considerations (required)

[Any security concerns that might be implicated in the change. "None" is OK, just be explicit here!]

Sketch

• Determine if each category of log items is applicable to the application and, if so, that it is being captured.
• If the log is not being captured, assert why it is not feasible to capture: either because it is not applicable to the application, not feasible due to infrastructure obfuscation, framework restriction, etc.