Why this matters
SOC 2 requires auditability and tamper evidence; consistent fields enable investigations and access reviews.
Every security-relevant action must append to an immutable, append-only audit log with fields: timestamp (UTC ISO8601), actor.user_id, actor.role, action, resource.id, result, trace_id, ip, user_agent. Logs must be signed or stored in WORM/immutable storage and forwarded to a SIEM.
SOC 2 requires auditability and tamper evidence; consistent fields enable investigations and access reviews.
Side-by-side examples engineers can pattern-match during review.
{ "event": "changed_settings" }{ "ts":"2025-08-28T18:30:00Z","actor":{"user_id":"u_123","role":"admin"},"action":"settings.update","resource":{"id":"org_9"},"result":"success","trace_id":"7f7c...","ip":"203.0.113.10","user_agent":"Chrome/139" }{"action":"user.login","trace_id":"abc","result":"failure"}{"action":"user.login"}From the same buckets as this rule.
Public services must require TLSv1.2 or higher and set HSTS (max-age ≥ 15552000, includeSubDomains). Reject plaintext HTTP and weak ciphers; cookies must be Secure and HttpOnly with SameSite set.