Audit Logging (Enterprise-Grade)
Definition
Audit logging is the tamper-evident recording of security-relevant events — who did what, to which resource, when, from where, and with what outcome. Unlike debug logs, audit logs are a product feature and a compliance requirement: they must be structured, complete, immutable, retained for a defined period, and exportable to customers’ SIEM systems.
Why it matters for AI jobs
Enterprise and government buyers require audit trails (SOC 2 CC7, NIST AU family, FedRAMP). AI products add new audit surfaces: prompt/response logging policies, tool-call records for agents, and model/data access trails. Engineers who can design an audit pipeline — event schema, append-only storage, retention, SIEM export — bring a differentiating skill that job posts increasingly name explicitly.
Key concepts
- Event taxonomy — authentication, authorization, data access, admin/config changes, agent tool calls.
- Structured schema — JSON events with actor, action, target, timestamp, source IP, result, request ID.
- Immutability — append-only stores, WORM object storage, hash chaining for tamper evidence.
- Retention & privacy — per-regime retention periods; excluding secrets/PII from log payloads.
- SIEM export — streaming to customer Splunk/Datadog/Sentinel via syslog, S3, or APIs.
- AI-specific auditing — recording agent actions and model I/O without storing sensitive content.
- Alerting — turning audit streams into detections (impossible travel, mass export, privilege escalation).
Learning path
- Define an audit event schema for an app you know well; enumerate 20 events across the taxonomy.
- Implement an append-only audit table (Postgres) with hash chaining; verify tamper detection.
- Add middleware that emits audit events automatically for authn/authz and admin actions.
- Build an export: batched delivery to object storage plus a webhook/syslog stream.
- Map your design to SOC 2 CC7 and NIST AU-2/AU-9 to be able to defend it in compliance terms.