An audit trail is a chronological record of events and activities within a system that shows who did what, when, and often from where. Built from logs across applications, operating systems, and network devices, it provides the evidence needed to reconstruct actions after the fact.
Audit trails support accountability, because they tie actions to individual identities, and they are the raw material for detecting intrusions, investigating incidents, and satisfying auditors. When an account deletes a sensitive file, a good trail shows the user, the timestamp, and the source host. The catch is integrity: if attackers or insiders can edit or erase the logs, the trail is worthless, so records should be write-once and shipped to a separate, protected system such as a SIEM. Two practical failures recur, collecting so much that nothing is reviewed, and never testing whether the logs actually capture the events an investigation would need. Retention also has to match legal and regulatory requirements.
How is an audit trail tested on the CISSP?
It falls under Domain 7, Security Operations. Know how logging supports accountability and non-repudiation, why log protection and centralization matter, and how audit trails feed monitoring and incident response.