How to fix Insufficient Logging & Monitoring
in .NET 8 Web API
Executive Summary
Insufficient Logging & Monitoring (OWASP A09:2021) is a silent killer. In .NET 8, if you're relying on default console outputs or catching exceptions without telemetry, you're flying blind while attackers map your attack surface. You need structured, correlated logs and real-time monitoring to detect lateral movement and brute-force attempts before they escalate.
The Vulnerable Pattern
[HttpPost("transfer")]
public IActionResult TransferFunds([FromBody] TransferRequest request)
{
try
{
_accountService.Transfer(request.From, request.To, request.Amount);
return Ok();
}
catch (Exception)
{
// VULNERABILITY: Swallowing the error or logging without context/structure.
// No record of WHO tried to transfer, from WHERE, or the specific FAILURE reason.
return StatusCode(500, "An error occurred.");
}
}The Secure Implementation
The secure code implements Structured Logging using Serilog and LogContext. Unlike plain text, structured logs (JSON) allow SIEMs like Splunk or ELK to index fields for rapid querying. We log the 'Who' (UserId), 'What' (Amount/Action), and 'Where' (IP Address) while using Correlation IDs (TransactionId) to trace the request across microservices. Critical security events (SecurityException) are logged at a 'Critical' level to trigger immediate SOC alerts, ensuring the API isn't a black box during an active exploit attempt.
// In Program.cs: Use Serilog for structured JSON logging builder.Host.UseSerilog((context, config) => { config.WriteTo.Console(new JsonFormatter()) .Enrich.FromLogContext() .Enrich.WithProperty("Application", "FinanceAPI"); });// In Controller: [HttpPost(“transfer”)] public IActionResult TransferFunds([FromBody] TransferRequest request) { var userId = User.FindFirstValue(ClaimTypes.NameIdentifier); var ip = HttpContext.Connection.RemoteIpAddress?.ToString();
using (LogContext.PushProperty("TransactionId", Guid.NewGuid())) { try { _logger.LogInformation("Initiating transfer: {Amount} from {From} to {To} by User {UserId} (IP: {IP})", request.Amount, request.From, request.To, userId, ip); _accountService.Transfer(request.From, request.To, request.Amount); _logger.LogInformation("Transfer successful"); return Ok(); } catch (SecurityException ex) { _logger.LogCritical(ex, "SECURITY ALERT: Unauthorized transfer attempt by User {UserId} from IP {IP}", userId, ip); return Forbid(); } catch (Exception ex) { _logger.LogError(ex, "Transfer failed for User {UserId}", userId); return StatusCode(500, "Internal Server Error"); } }
}
Your .NET 8 Web API API
might be exposed to Insufficient Logging & Monitoring
74% of .NET 8 Web API apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.