VNX-778: Insufficient Logging

Production code or configuration that switches logging or the audit trail off outright: logging.disable(), root or audit loggers at OFF, silent winston/pino loggers, console methods replaced, CloudTrail enable_logging = false.

Field	Value
Rule ID	`VNX-778`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python, Java, Kotlin, JavaScript / TypeScript, Terraform, Config files
CWE	CWE-778
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`audit-logging` `logging-disabled` `cwe-778`
Source	`internal/sast/rules/vnx-778.rego`

Overview

VNX-778 maps to CWE-778: Insufficient Logging. It reports logging switched off outright in production code or configuration:

Python logging.disable() with no level or ERROR/CRITICAL, a root, audit, security or auth logger set .disabled = True, and the root logger raised above CRITICAL
Java root-logger setLevel(Level.OFF), Configurator.setRootLevel(Level.OFF) and LogManager.getLogManager().reset() with no handler installed afterwards
Spring logging.level.root=OFF (or a security/audit logger), log4j rootLogger=OFF, YAML root: OFF under logging.level, logback/log4j2 <root level="off">
winston silent: true, logger.silent = true, pino level: 'silent' or enabled: false, and console.log/info/warn/error replaced with an empty function
Terraform aws_cloudtrail with enable_logging = false

Not reported: switches guarded by a quiet, verbose, silent, test or debug condition, logging.disable(logging.NOTSET), quietening a named third-party logger, test and setup files. Whether a specific security event is logged is not decidable line by line and is not judged.

Why This Matters

With the root or audit logger off, failed logins, access-control denials and attacks leave no record, so an intrusion cannot be detected or reconstructed.

What Gets Flagged

logging.disable(logging.CRITICAL)            # FLAGGED
audit.disabled = True                        # FLAGGED (audit = logging.getLogger("audit"))

logging.level.root=OFF                       # FLAGGED

resource "aws_cloudtrail" "main" {
  enable_logging = false                     # FLAGGED
}

Remediation

Lower verbosity per logger (logging.getLogger("noisy.lib").setLevel(logging.WARNING)) instead of disabling the root or audit logger.
Keep CloudTrail trails enabled.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-778
// nosec vnx-778

Or record an ignore rule: vulnetix ignore add --rule vnx-778 --reason "...". See Suppressing findings.