Audit Logs

Protect Audit Logs from Tampering

Audit logs are most valuable when something has already gone wrong. They help answer who changed a permission, which account performed a sensitive action, and what happened before an incident was detected. But there is a difficult dependency hidden in that design: if the same compromised system can freely rewrite its own audit history, the evidence may become unreliable exactly when responders need it most. The defensive goal is therefore not merely to record events. It is to make important audit records harder to alter without authorization and make suspicious loss or modification easier to detect.