# Security monitoring: connect important events to an owner who can act

Source: https://www.web3sec.news/blog/security-monitoring-runbook
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Map high-impact actions to specific audit sources.
- [ ] Record collection delay, retention and known gaps.
- [ ] Exclude secrets and protect log integrity.
- [ ] Give alerts a responder and containment procedure.
- [ ] Test raw event through acknowledged response end to end.

## References
- [OWASP: logging cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html)
- [AWS: CloudTrail recording and event history](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html)