infospace-bench/infospaces/patterns-of-it-securita-architecture/artifacts/entities/pattern-security-event-taxonomy.md

Pattern: Security Event Taxonomy

Status: seed Readiness target: RL3 production Primary owners: NetKingdom, Railiance platform Genesis family: Detection and response

Problem

Logs become noisy and hard to correlate when security-relevant events do not share names, fields, severities, and actor/resource semantics.

Context

Use this pattern for identity, authorization, OpenBao, Kubernetes, artifact-store, ops access, workload events, and incident response.

Forces

• Different systems emit different event shapes.
• Tenant-visible audit requires careful projection.
• Agents and humans need separate attribution.
• Detection and response need severity and category consistency.

Solution

Define a shared taxonomy for security events with event class, actor, tenant, resource, action, outcome, severity, source, correlation id, and visibility rules.

Verification

• Critical systems emit events matching required fields.
• Event classes map to detection and response workflows.
• Tenant-visible fields are explicitly marked.
• Correlation ids link identity, policy, secret, and workload events.

Related Patterns

• Central Audit Ledger.
• Tenant Audit Log View.
• Runtime Threat Detection.
• Incident Runbook Library.