2.12 All authentication decisions are logged

Verify that all suspicious authentication decisions are logged. This should include requests with relevant metadata needed for security investigations.

Levels: 2, 3