Security Audit Logging

This gives you structured audit logging with compliance in mind. It covers the essentials like Winston for Node.js with Elasticsearch transport, retention policies, and proper formatting with timestamps and request IDs. The best practices section is solid on the obvious stuff like never logging passwords and always logging failed attempts. If you're dealing with SOC 2, HIPAA, or PCI-DSS requirements, this gets you most of the way there. The reference guides show implementations across Node.js, Python, and Java, which is helpful if you're working in a polyglot environment. The main value is having the SIEM integration patterns ready to go rather than figuring out the transport configuration yourself.

skills.sh installs: 568
GitHub stars: 379
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add aj-geddes/useful-ai-prompts --skill security-audit-logging --agent claude-code

Installs into .claude/skills of the current project.

Files

Overview

Implement comprehensive audit logging for security events, user actions, and system changes with structured logging, retention policies, and SIEM integration.

When to Use

Compliance requirements (SOC 2, HIPAA, PCI-DSS)
Security monitoring
Forensic investigations
User activity tracking
System change auditing
Breach detection

Quick Start

Minimal working example:

// audit-logger.js
const winston = require("winston");
const { ElasticsearchTransport } = require("winston-elasticsearch");

class AuditLogger {
  constructor() {
    this.logger = winston.createLogger({
      level: "info",
      format: winston.format.combine(
        winston.format.timestamp(),
        winston.format.json(),
      ),
      transports: [
        // File transport
        new winston.transports.File({
          filename: "logs/audit.log",
          maxsize: 10485760, // 10MB
          maxFiles: 30,
          tailable: true,
        }),

SKILL.md on GitHub