Audit Logging

Overview

Audit logs capture security-relevant actions for accountability, investigation, and compliance evidence.

What to Log

• Authentication events
• Privilege and policy changes
• Data access to sensitive resources
• Administrative operations

flowchart TD
    A[User or System Action] --> B[Audit Event]
    B --> C[Immutable Storage]
    C --> D[Security Review]

Practical Example

{
  "timestamp": "2026-09-06T16:30:00Z",
  "actor": "admin-42",
  "action": "role.update",
  "target": "user-1001",
  "result": "success"
}

Production Example

Audit pipelines often forward events to immutable storage with retention controls and restricted read permissions.

Common Pitfalls

• Logging events without actor identity
• Allowing audit logs to be modified or deleted
• No monitoring for anomalous admin actions

Key Takeaways

• Audit logging is essential for compliance and incident response.
• Integrity and retention controls are mandatory.
• High-value events should be searchable and monitored.