Do not drop log events from known users such as internal systems, scanners or penetration testers. Tag them with a field and filter on the tag when you alert or report. Exclusion removes evidence, and an attacker who borrows a trusted identity then becomes invisible.
What OWASP says
The OWASP logging guidance says never to exclude events from known users, including internal systems and pen testers, and to flag them instead. The reasoning is practical. Once an identity is on an allow list that skips logging, it is a blind spot.
Why exclusion goes wrong
- Stolen credentials. If an attacker steals a service account that your pipeline ignores, nothing records what they do.
- Scope creep. A tester told to probe one app starts on another, and no log shows it.
- Mistaken identity. An IP range listed as a scanner gets reassigned.
- Compliance gaps. Auditors may ask for all privileged activity, internal or not.
Flag instead
Add fields to events from known actors:
- actor_type: employee, service, scanner, tester
- test_run_id: the engagement or scan identifier
- source_label: the named tool or team
Alert rules then say "ignore tester events for brute force alerts during run X" without deleting anything. After the engagement, you can reconcile: every alert that fired should map to a planned action, and anything outside the plan deserves a look.
How to run a test with logs intact
- Agree dates, sources and scope in writing with the tester.
- Give them a dedicated identity and a recognizable header or user agent.
- Tell the monitoring owner before it starts, so alerts are expected.
- Keep alerts firing, but route them to a separate channel for the duration.
- After the test, compare the report with the logs. Gaps show where detection missed.
That last step is the real benefit. A pen test is a free exercise for your detection. If the logs show attacks that raised no alert, you have a tuning to-do list.
Same rule for internal tools
Health checkers, synthetic monitors and vulnerability scanners generate odd traffic. Label them in the same way. When an alert fires for a failed login burst, you can see in seconds that it came from your own checker and close it without removing the data.
Quick check
Is it fine to skip logging health checks?
Dropping very high volume, low risk lines such as load balancer pings is a cost decision many teams make. Do it narrowly and by exact path, never by identity.
Should staff actions be logged?
Yes. Administrative and privileged activity belongs in your logs regardless of who performs it.
Sources
Last reviewed: 19 October 2026.
