A Crash Course in Audit Logs

Application audit logs include a breadcrumb trail of all user activity and the logs are used to answer many different questions in a variety of contexts. Development teams perform analytics on the logs. Security teams write threat detection logic on the logs. Customers will arbitrarily request the logs. Government regulations (GDPR, CCPA, etc.) will mandate that you save them, but then eventually delete them. Your responsibility as a developer or security engineer is to make sure the logs are useful and usable by all of these different stakeholders—and that means robust, high-quality log management tooling. In this talk, we’ll explain the purpose and value of audit logs, present a best-practices logging checklist, and break down an all-purpose log reference format that you can use today!

Justin Massey

Justin Massey is a Product Manager at Datadog. His background in managing the technical operations of an MSP led him to discovering weaknesses in many businesses’ networks and applications. After leaving the MSP, he transitioned into the role of penetration tester and application security engineer to identify the weaknesses before the attackers. Justin’s current focus is detecting security threats in real time.

[FullstackMac]

Great video I love that there's value within the first 4 minutes

[haraheiquedossantos]

Hello. Good video.
In your opinion, where is the best place to save the audit logs. Do you think save these kind of logs in relational databases is a bad ideia? Because in the long term, it worsens the performance of searching the logs in addition to consuming a large amount of data inside database. Which tool do you think is better tho?

[ajantamoushumi]

Isnt it a frowned upon to include PII in audit logs? Asking cause your example includes IP address. Sorry, I dont have a technical background, just curious