Time to Contain

Audit trail

An audit trail records who or what did what, when, on what evidence and with what result. For automated containment it should show the trigger, the decision, the approver, the command and the outcome. A page that says every action is auditable has not yet said what is recorded.

Definition

The rubric looks for a per-action record with its fields named, and for export and retention stated. A claim without those is partial.

Ask whether the record can be changed after the fact and whether it survives the case being closed.

Audit trail in Google Security Operations's documentation

Google's Response Agent documentation says executed actions show success or failure status in the workflow, and read-only users can view execution history and output, with no export or retention stated. vendor claim docs.cloud.google.com, read

The example names a vendor and its own page. A vendor's use of Audit trail may differ from the definition above; the rubric uses the definition on this page.