What is 'authentication event logging' and what specific events must be logged for security monitoring?

• A.Authentication logging is optional; logging all auth events creates privacy concerns that outweigh benefits
• B.Authentication logs should be stored in the same database as user credentials for easy correlation
• C.Authentication logging only needs to record failed attempts; successful logins don't need logging
• D.Authentication events to log: successful login (user ID, IP, device fingerprint, timestamp), failed login attempt (username, IP, failure reason), MFA success/failure, password change/reset, account lockout and unlock, new device/location login, session creation and termination, account linking/unlinking, and privilege escalation. Each event should include: who, what, when, from where - enabling forensic analysis after a breach