What is 'authentication event logging' and what specific events must be logged for security monitoring?

• A.Authentication events to log: the full password of each failed attempt (to help users), session cookie values (for debugging), MFA seed values, and the plaintext answers to security questions, plus the browser's saved passwords. Each event should include: the raw secret, the time, and the tester's name - enabling forensic analysis after a breach of the system, a record that the support team reads for each customer who calls about a login problem
• B.Events worth recording: page views, mouse clicks, scroll depth (for product analytics), search queries, and ad impressions, plus CDN cache hits. Each event should include: campaign, template, and variant - enabling conversion analysis after a launch of the marketing site, a log design that serves the marketing team rather than the security team, with the data kept in a warehouse that the analysts query for weekly reports on traffic sources and campaign performance
• C.Authentication events to log: successful login (user ID, IP, device fingerprint, timestamp), failed login attempt (username, IP, failure reason), MFA success/failure, password change/reset, account lockout and unlock, new device/location login, session creation and termination, account linking/unlinking, and privilege escalation. Each event should include: who, what, when, from where - enabling forensic analysis after a breach