Audit logging

A chronological record of system events used to track user actions and maintain security accountability.

Audit logging turns system activity into a verifiable trail of accountability. It captures essential telemetry: user IDs, source IPs, and specific API response codes. Engineering teams use tools like AWS CloudTrail or Datadog to monitor high-stakes actions (privilege escalations, database deletions, or PII access). This data serves as the primary evidence for SOC2 audits and post-incident forensics. By storing immutable logs for 90 days or longer, you ensure the ability to reconstruct any sequence of events and prove exactly who touched what.

https://csrc.nist.gov/glossary/term/audit_log