If you're logging access events, you need to think like an investigator. When something goes wrong, you'll need to reconstruct who did what, from where, and on which system. Logging for "normal ops" isn't enough.
Capture these fields at a minimum for every session or connection event:
* Timestamp (UTC with timezone offset)
* User identifier (username, service account ID)
* Source IP and geolocation
* Destination resource (hostname, IP, app ID)
* Action performed (connect, disconnect, file transfer, command executed)
* Protocol and port
* Session duration
* Status (success, failure, reason for failure)
* Device fingerprint (if applicable)
Store these logs immutably, separate from your main system. Correlate them with your IDP logs. Without this baseline, your "security investigation" is just guessing.