---
name: logging-recommendations
description: Analyze repository context and generate environment-specific, cost-conscious security logging recommendations.
---

# Logging Recommendations Advisor Skill

This skill analyzes the collected repository context and constructs a customized, tiered, and cost-aware security telemetry recommendation report.

## Trigger Instructions

Run this skill after the repository context has been collected and user clarifications have been addressed.

## Core Capabilities

1. **Gaps Analysis**: Match the detected tech stack against standard security logging matrices (e.g., OWASP, MITRE ATT&CK, cloud provider landing zones).
2. **Environment Calibration**:
   - **Sandbox**: Minimize ingestion cost, prioritize only critical error and security baseline telemetry.
   - **Development**: Support debugging and early threat signal identification with short-term retention.
   - **Integration**: Verify security-relevant flows and cross-service boundaries.
   - **Performance**: Suppress verbose log calls that distort performance tests; capture critical audit logs.
   - **Production**: Maximum telemetry, structured logs, strict retention, alert rules, and SIEM ingestion.
3. **Cost-Aware Optimization**:
   - Focus on high-signal logs (e.g., failed login attempts, configuration changes).
   - Sample or aggregate high-volume telemetry (e.g., database queries, network flow logs).
   - Discourage broad debug logging or raw payload logging.
4. **Structured Format**: Recommend JSON format with standard headers (e.g., Correlation IDs, Actor UUIDs, outcome codes, ISO 8601 UTC timestamps).

## Output Generation

Output the final report to `docs/security/logging-recommendations.md` matching the layout in `assets/logging-recommendations.md`.