What is an audit log?¶

An audit log is a record intended to show significant actions within a system so that activity can later be reviewed, checked or accounted for.

It often records who or what performed an action, what was affected, when it happened and whether it succeeded.

Avoid this assumption: That because a record is called an audit log, it is complete, tamper-proof and suitable for proving personal responsibility. That should never be assumed.

Audit logs vary widely. One may record administrator changes in detail. Another may record only selected user actions. Some are created by the source system; others are assembled by a cloud platform, management console or monitoring product.

An audit entry may show that an account changed permissions, accessed a record, created a user, deleted a file or altered a configuration. Fields may include the actor account, target object, action, result, source address, session or request ID and timestamp.

This can provide strong evidence about what the system recorded. But the actor field usually identifies an account, service principal or process, not necessarily a particular person. Administrators may act on behalf of users. Accounts may be shared or compromised. Automated processes may perform changes without direct human action.

Investigators should establish what events the audit system records, whether logging was enabled at the relevant time and what retention applied. Ask whether users or administrators could disable, alter or delete the records. Determine whether the export is complete and whether any filters were applied.

Preserve original audit data, field definitions and relevant configuration. Obtain surrounding entries and correlate important actions with authentication logs, application records, change history, tickets, communications and device evidence.

Operational takeaway¶

An audit log can provide a structured record of significant system activity, but completeness, integrity and personal attribution must be established rather than assumed.