# Audit Log

A chronological record of events and actions taken on a system, used to track activity and investigate incidents.

An **audit log[↗](/audit-log)** is a chronological record that captures events and actions taken on a system, who logged in, what files were accessed, what settings were changed, and when. It creates an evidence trail that exists independently of what any single user claims happened.

Audit logs are essential for investigating a security incident after the fact, since they can reveal exactly how an attacker moved through a system or when a legitimate account started behaving suspiciously. Many compliance frameworks also require organizations to retain audit logs for a minimum period and protect them from tampering.