What makes a good audit trail?
Tags: auditlogs, saas, software, security
Published: 2022-03-07 20:58:16

---
title: What makes a good audit trail?
published: true
date: 2022-02-05 00:00:00 UTC
tags: auditlogs, SaaS, software, security
canonical_url: https://apptrail.com/blog/2022/02/05/what-makes-a-good-audit-trail
description: At Apptrail, we obsess over audit trails and how to make them most valuable for our customers, so we thought we'd examine some real world examples of audit trails and see what makes some stand out from others.
---

At Apptrail, we obsess over audit trails and how to make them most valuable for our customers, so we thought we'd examine some real world examples of audit trails and see what makes some stand out from others.

There's a lot of details and requirements that go into building an audit trails solution, from availability and immutability to security and delivery, but, let's examine some of the features that differentiate solutions from one another.

## What's an audit trail anyway?[​](#whats-an-audit-trail-anyway "Direct link to heading")

_If you're already familiar with audit trails, feel free to skip this section._

An audit trail is a way to record user or API activity and surface that information. Generally, an audit trail lets admins or users answer the _Who_, _When_, _Where_, and _What_ of an action. Audit trails can be used to monitor suspicious activity or replay activity in the aftermath of an event.

We use _audit trails_, _audit logs_, and _audit events_ here interchangeably.

## Some real world examples[​](#some-real-world-examples "Direct link to heading")

Lets take a whirl through some popular tools that offer audit logs.

### Google Admin[​](#google-admin "Direct link to heading")

Google Workspace has a mature audit logs offering. Let's see what we can do:

![G Admin audit logs](https://apptrail.com/assets/images/gadmin1-82647547805b5fba819d9c6619f8cece.png)

Immediately, we can see all the recent actions that took place with Google workspace. The information contains the event name, description, time, who did the action (_actor_), and the IP address associated with the actor. The data is filterable and offers a basic CSV export through the UI. Google offers several audit logs, and data retention (how long the data is stored), ranges from 6 to 15 months.

### Stripe[​](#stripe "Direct link to heading")

Stripe uses logs in a few places. Let's take a look.

#### Security history[​](#security-history "Direct link to heading")

![Stripe security history](https://apptrail.com/assets/images/stripe1-bbc2ef7620b5aa3760c98ab8b8244714.png)

These events contain important actions, and similarly add information about the when, who, and where of the action. The results are accessible in the Dashboard UI, and exportable to CSV.

#### Request logs[​](#request-logs "Direct link to heading")

Stripe also offers developer oriented request logs. These are often used for debugging but are also essentially audit logs.

![Stripe request logs](https://apptrail.com/assets/images/stripe2-eb6db5bd9019140a58eee0e445783115.png)

The Stripe request logs contain full request, response, and context data for every HTTP request made to the API. They're viewable through the Stripe Dashboard UI and filterable on each dimension. Stripe request logs have a 15 month data retention period.

### Github[​](#github "Direct link to heading")

Github offers a pretty full featured [audit logs solution](https://docs.github.com/en/enterprise-cloud@latest/admin/user-management/managing-organizations-in-your-enterprise/streaming-the-audit-logs-for-organizations-in-your-enterprise-account)to its Enterprise customers. You can access Github audit logs by 1) using the web UI, 2) polling with the REST API, and 3) streaming to destinations like S3 or Splunk using their audit log streaming feature.

Streaming audit logs is an important feature that a lot of audit logs solutions lack. It unlocks a lot of usecases, like being able to explore a large amount of data or retaining ownership over data, that a UI or API based approach don't allow.

### AWS CloudTrail[​](#aws-cloudtrail "Direct link to heading")

AWS offers audit logs for most of its services using [CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html). You can query audit logs from the Console UI and using the AWS APIs. You can also deliver AWS audit logs to your S3 bucket or CloudWatch logs group. CloudTrail offers a pretty limited (heavily paginated and throttled) [LookupEvents](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_LookupEvents.html) API to query audit data but in general nudges you towards sending audit logs to S3.

### And more[​](#and-more "Direct link to heading")

There's many more software services offering audit logs. For the sake of brevity:

- [Zendesk](https://support.zendesk.com/hc/en-us/articles/4408828001434) offers audit logs through a UI, with filters, CSV export, and a REST query API. Logs are retained for 1 year, which is not configurable.
- 1Password offers a UI based [activity log](https://support.1password.com/activity-log/) with viewable and searchable activity including event, actor, and date, but omitting context such as IP. The activity log has a non configurable retention of 6 months. Additionally, they offer a more extensive REST [Events API](https://blog.1password.com/introducing-events-api/) for programmatic access and access to more audit events.

## Comparison[​](#comparison "Direct link to heading")

That covers a bit about audit trails, how customers use them, and what elements make them most useful to customers. Summarizing our survey:

| | Filterable? | Exportable? | API access? | Streaming? | Configurable retention? |
| --- | --- | --- | --- | --- | --- |
| G Admin | ✔️ | ✔️ | ❌ | ❌ | ❌ |
| Stripe | ✔️ | ✔️ | ❌ | ❌ | ❌ |
| 1Password | ✔️ | ✔️ | ✔️ | ❌ | ❌ |
| Zendesk | ✔️ | ✔️ | ✔️ | ❌ | ❌ |
| Github | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
| CloudTrail | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |

We can see audit trails vary on several dimensions:

#### Self service access[​](#self-service-access "Direct link to heading")

Admins being able to access the audit logs themselves, without needing a manual request, is the first step to a customer facing audit trail. At the bare minimum, a web UI to explore audit logs should be provided.

#### Exportability[​](#exportability "Direct link to heading")

Viewing audit logs in a UI is good for one off usecases, but users often want to export the data for analysis with other tools.

#### Programmatic API access[​](#programmatic-api-access "Direct link to heading")

Users want to be able to interact with their data programatically, for scripting, workflows, etc. The API should allow for querying events by time and filtering on fields. These APIs are generally paginated and throttled, as there is an unbounded number of audit logs.

#### Audit log streaming[​](#audit-log-streaming "Direct link to heading")

When there's a large amount of audit logs, a poll based API is not sufficient, and users will want to have their data pushed into tools like S3 or Splunk for data analysis.

#### Data retention[​](#data-retention "Direct link to heading")

Audit logs must be immutable to protect their integrity, but they are usually retained for a period of time, ranging from months to years. Ideally, this should be configurable by the user. Adding audit log streaming also automatically enables this, as it gives the customer ownership of their audit data (essentially unlimited retention).

## Conclusion[​](#conclusion "Direct link to heading")

That was a short overview of some popular tools and how they offer audit trails to their customers. We can see there are a range of different features that go into an audit logs solution, and software providers vary in what they currently offer.

Do you have any examples of great audit logs? Feel free to share.

<svg fill="#8F99A8" data-icon="rocket-slant" width="50" height="50" viewbox="0 0 20 20"><path d="M10 5c2.121-2.121 6.308-2.924 8-3-.076 1.692-.879 5.879-3 8-1.192 1.192-2.543 1.823-3.748 2.384-.442.207-.865.404-1.252.616-.203.111-.597.302-.986.49-.444.215-.88.426-1.014.51l-2-2c.158-.252 1-2 1-2s1.37-3.37 3-5zm5 1a1 1 0 11-2 0 1 1 0 012 0zM3 17s0-2 2-4l2 2c-2 2-4 2-4 2zm11-2l-4 4-1.298-4.233c1.033-.56 1.881-.962 2.643-1.322 1.275-.604 2.307-1.092 3.554-2.015L14 15zM1 10l4-4 3.557-.899c-.923 1.247-1.412 2.28-2.015 3.554-.36.762-.762 1.61-1.322 2.643L1 10z" fill-rule="evenodd"></path></svg>

Interested in adding world class audit logs to your own SaaS?<!-- --> [**Apptrail**](https://apptrail.com?utm_source=blog) <!-- -->is fully managed Audit trails as a Service.<!-- --> [Learn more](/docs/applications/guide) or<!-- --> [Get started](https://apptrail.com/signup?utm_source=blog).