add a script for audit trail analysis