DataTerminology.comNEW
Recording security-relevant events and data access to provide accountability, traceability, and forensic evidence.
DESCRIPTION
Audit logging creates a tamper-evident record of who did what, when, where, and to which resource. Logs support investigations, compliance reporting, and non-repudiation. Effective systems ensure immutability, time synchronization, and comprehensive coverage of administrative and data access events. Centralized collection and retention policies help meet regulatory requirements. Fine-grained logs must balance privacy and utility. Integrations with SIEM enable alerting and correlation. Clear governance defines ownership, retention, and access to logs.
ALTERNATIVE DEFINITIONS
Wikipedia
An audit trail (also called audit log) is a security-relevant chronological record, set of records, or destination and source of records that provide documentary evidence of the sequence of activities that have affected at any time a specific operation, procedure, or event.
Highlights chronology and evidentiary purpose of audit records.
Google Cloud
Cloud Audit Logs maintains a record of actions taken by users in your Google Cloud resources.
Vendor framing focused on user actions within cloud resources.
RELATED TERMS
Immutable Log Append-Only SIEM Access Control Change Management Compliance Non-repudiation Forensics Lineage Observability
COMPETING TERMS
Application Logging
RELATIONS
- Broader: Logging
KNOWLEDGE AREAS
Data Security Observability & Telemetry Data Management Data Governance
TARGET AUDIENCE
DevOps Engineer Data Engineer Data Steward Cloud Architect Chief Information Officer
EXTERNAL SOURCES
- Wikipedia - Audit trail
- NIST - Guide to security log management
- Microsoft - Azure activity and audit logs
- AWS - CloudTrail audit logging
TOP QUESTIONS
What events should Audit Logging capture?
Capture authentication, authorization decisions, administrative changes, data access, and configuration changes. Include actor identity, timestamp, resource, and outcome.
Category: Requirements
How do you make audit logs tamper-evident?
Use append-only storage, cryptographic hashing, and secure time-stamping. Limit write access and replicate logs to immutable stores.
Category: Best practices
How long should audit logs be retained?
Retention depends on regulation and risk, commonly 1–7 years. Align with legal, privacy, and storage constraints.
Category: Compliance
How does Audit Logging differ from application logging?
Audit logging emphasizes security-relevant, structured, immutable records. Application logs often focus on debugging and may be verbose or mutable.
Category: Misunderstanding
What privacy concerns apply to Audit Logging?
Avoid logging sensitive data, minimize personal data, and control access. Apply pseudonymization and strict retention policies where necessary.
Category: Risk
How do SIEM systems use audit logs?
SIEMs ingest logs, normalize events, correlate patterns, and trigger alerts. They support detection, response, and reporting.
Category: Overview
What standards reference Audit Logging?
NIST SP 800-92, ISO 27001 Annex A, PCI DSS, and SOC 2 provide guidance and requirements for logging and monitoring.
Category: Compliance
How should time be handled in audit logs?
Use synchronized clocks (e.g., NTP) and include timezone or UTC. Unsynchronized timestamps hinder investigations.
Category: Best practices
How to scale Audit Logging in distributed systems?
Adopt centralized log pipelines, schema standards, backpressure handling, and tiered storage with lifecycle policies.
Category: How-To