{"id":333,"date":"2025-05-31T07:12:37","date_gmt":"2025-05-31T07:12:37","guid":{"rendered":"https:\/\/finopsschool.com\/blog\/?p=333"},"modified":"2025-05-31T10:58:40","modified_gmt":"2025-05-31T10:58:40","slug":"a-comprehensive-tutorial-on-audit-logs-in-devsecops","status":"publish","type":"post","link":"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/","title":{"rendered":"A Comprehensive Tutorial on Audit Logs in DevSecOps"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\">1. Introduction &amp; Overview<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\">What are Audit Logs?<\/h3>\n\n\n\n<p>Audit logs are detailed, chronological records of events and activities within a system. They capture who performed an action, what action was taken, when it occurred, and where it happened (e.g., which resource or service). In DevSecOps, audit logs are essential for tracking user actions, system events, and configuration changes to ensure security, compliance, and operational transparency.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"1024\" src=\"https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_oin77goin77goin7-1024x1024.png\" alt=\"\" class=\"wp-image-375\" srcset=\"https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_oin77goin77goin7-1024x1024.png 1024w, https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_oin77goin77goin7-300x300.png 300w, https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_oin77goin77goin7-150x150.png 150w, https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_oin77goin77goin7-768x768.png 768w, https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_oin77goin77goin7-1536x1536.png 1536w, https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_oin77goin77goin7.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">History or Background<\/h3>\n\n\n\n<p>Audit logging originated in early computing systems, where manual records tracked system access and changes. With the advent of DevOps and DevSecOps, audit logs have become automated and centralized, driven by the need to secure cloud-native environments and CI\/CD pipelines. Modern standards like GDPR, HIPAA, and SOC 2 have further emphasized the importance of audit logs for compliance and accountability.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Why is it Relevant in DevSecOps?<\/h3>\n\n\n\n<p>Audit logs are critical in DevSecOps for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Security Monitoring<\/strong>: Detecting unauthorized access or suspicious activities.<\/li>\n\n\n\n<li><strong>Compliance<\/strong>: Providing evidence for regulatory audits.<\/li>\n\n\n\n<li><strong>Incident Response<\/strong>: Enabling teams to trace the root cause of security incidents or failures.<\/li>\n\n\n\n<li><strong>Transparency<\/strong>: Ensuring accountability across development, security, and operations teams.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">2. Core Concepts &amp; Terminology<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Key Terms and Definitions<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Audit Log<\/strong>: A record of an event, including timestamp, user, action, and resource.<\/li>\n\n\n\n<li><strong>Log Aggregation<\/strong>: Collecting logs from multiple sources into a centralized system.<\/li>\n\n\n\n<li><strong>Log Retention<\/strong>: Storing logs for a defined period to meet compliance requirements.<\/li>\n\n\n\n<li><strong>Immutable Logs<\/strong>: Logs that cannot be altered to ensure integrity.<\/li>\n\n\n\n<li><strong>SIEM<\/strong>: Security Information and Event Management systems for real-time log analysis.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Term<\/th><th>Description<\/th><\/tr><\/thead><tbody><tr><td><strong>Audit Log<\/strong><\/td><td>Record of events or changes within a system for auditing and analysis<\/td><\/tr><tr><td><strong>Immutable Logging<\/strong><\/td><td>Ensuring logs cannot be modified or deleted once created<\/td><\/tr><tr><td><strong>Non-Repudiation<\/strong><\/td><td>The assurance that someone cannot deny the validity of their action<\/td><\/tr><tr><td><strong>SIEM<\/strong><\/td><td>Security Information and Event Management systems that analyze logs<\/td><\/tr><tr><td><strong>Event<\/strong><\/td><td>A specific action like login, file change, configuration update, etc.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">How It Fits into the DevSecOps Lifecycle<\/h3>\n\n\n\n<p>Audit logs are integral to every phase of the DevSecOps lifecycle:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Plan<\/strong>: Capture logging requirements for compliance and security.<\/li>\n\n\n\n<li><strong>Code<\/strong>: Log code changes in version control systems (e.g., Git commit logs).<\/li>\n\n\n\n<li><strong>Build<\/strong>: Record build events in CI\/CD pipelines.<\/li>\n\n\n\n<li><strong>Deploy<\/strong>: Track deployment activities and configuration changes.<\/li>\n\n\n\n<li><strong>Operate<\/strong>: Monitor runtime events in production environments.<\/li>\n\n\n\n<li><strong>Monitor<\/strong>: Analyze logs for security threats, performance issues, or anomalies.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">3. Architecture &amp; How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Components<\/h3>\n\n\n\n<p>An audit logging system typically includes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Log Generators<\/strong>: Applications, services, or systems that produce logs.<\/li>\n\n\n\n<li><strong>Log Collectors<\/strong>: Tools like Fluentd or Logstash that gather logs from multiple sources.<\/li>\n\n\n\n<li><strong>Log Storage<\/strong>: Databases or systems like Elasticsearch, Splunk, or AWS S3.<\/li>\n\n\n\n<li><strong>Log Analysis Tools<\/strong>: SIEM platforms (e.g., Splunk, Elastic SIEM) or custom dashboards for insights.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"1024\" src=\"https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_uz4oehuz4oehuz4o-1024x1024.png\" alt=\"\" class=\"wp-image-376\" srcset=\"https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_uz4oehuz4oehuz4o-1024x1024.png 1024w, https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_uz4oehuz4oehuz4o-300x300.png 300w, https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_uz4oehuz4oehuz4o-150x150.png 150w, https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_uz4oehuz4oehuz4o-768x768.png 768w, https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_uz4oehuz4oehuz4o-1536x1536.png 1536w, https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_uz4oehuz4oehuz4o.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Internal Workflow<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>An event occurs (e.g., user login, configuration change).<\/li>\n\n\n\n<li>The system generates a log entry with metadata (timestamp, user ID, action).<\/li>\n\n\n\n<li>Logs are collected and forwarded to a central repository.<\/li>\n\n\n\n<li>Logs are stored, indexed, and analyzed for anomalies or compliance checks.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture Diagram Description<\/h3>\n\n\n\n<p>Imagine a diagram with:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Left Side<\/strong>: Microservices, CI\/CD tools, and cloud services generating logs.<\/li>\n\n\n\n<li><strong>Middle<\/strong>: A log collector (e.g., Fluentd or Logstash) aggregating logs from various sources.<\/li>\n\n\n\n<li><strong>Right Side<\/strong>: A storage system (e.g., Elasticsearch) feeding into a SIEM tool (e.g., Splunk) for analysis and visualization.<\/li>\n\n\n\n<li><strong>Arrows<\/strong>: Showing the flow from log generation to collection, storage, and analysis.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>&#091;Source System] --&gt; &#091;Log Collector] --&gt; &#091;Aggregator\/Processor] --&gt; &#091;Storage]\n                                                        |\n                                                    &#091;Analyzer \/ Alerting]\n                                                        |\n                                                &#091;SIEM \/ Incident Response]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Integration Points with CI\/CD or Cloud Tools<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CI\/CD<\/strong>: Jenkins, GitLab, or GitHub Actions log pipeline events like builds and deployments.<\/li>\n\n\n\n<li><strong>Cloud<\/strong>: AWS CloudTrail for API calls, Azure Monitor for resource activity, or Google Cloud Logging for cloud events.<\/li>\n\n\n\n<li><strong>Containers<\/strong>: Kubernetes audit logs for cluster activities, such as pod creation or deletion.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Installation &amp; Getting Started<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Basic Setup or Prerequisites<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A Linux-based system (e.g., Ubuntu 20.04).<\/li>\n\n\n\n<li>Access to a log management tool (e.g., ELK Stack: Elasticsearch, Logstash, Kibana).<\/li>\n\n\n\n<li>Basic command-line knowledge.<\/li>\n\n\n\n<li>Network access for log forwarding.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Hands-on: Step-by-Step Beginner-Friendly Setup Guide<\/h3>\n\n\n\n<p>This guide sets up audit logging using the ELK Stack (Elasticsearch, Logstash, Kibana) to collect and visualize system logs.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Install Elasticsearch<\/strong><\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>   sudo apt-get update\n   sudo apt-get install openjdk-11-jdk\n   wget -qO - https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch | sudo apt-key add -\n   sudo apt-get install apt-transport-https\n   echo \"deb https:\/\/artifacts.elastic.co\/packages\/7.x\/apt stable main\" | sudo tee \/etc\/apt\/sources.list.d\/elastic-7.x.list\n   sudo apt-get update &amp;&amp; sudo apt-get install elasticsearch\n   sudo systemctl start elasticsearch<\/code><\/pre>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\">\n<li><strong>Install Logstash<\/strong><\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>   sudo apt-get install logstash<\/code><\/pre>\n\n\n\n<p>Configure Logstash to collect logs by creating <code>\/etc\/logstash\/conf.d\/audit.conf<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>   input {\n     file {\n       path =&gt; \"\/var\/log\/auth.log\"\n       type =&gt; \"syslog\"\n     }\n   }\n   output {\n     elasticsearch {\n       hosts =&gt; &#091;\"localhost:9200\"]\n       index =&gt; \"audit-logs-%{+YYYY.MM.dd}\"\n     }\n   }<\/code><\/pre>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li><strong>Install Kibana<\/strong><\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>   sudo apt-get install kibana\n   sudo systemctl start kibana<\/code><\/pre>\n\n\n\n<p>Access Kibana at <code>http:\/\/localhost:5601<\/code> to visualize logs.<\/p>\n\n\n\n<ol start=\"4\" class=\"wp-block-list\">\n<li><strong>Configure System Logs<\/strong><br>Ensure your application or system (e.g., <code>\/var\/log\/auth.log<\/code> for system authentication logs) is generating audit logs.<\/li>\n\n\n\n<li><strong>Test the Setup<\/strong><br>Trigger a system event (e.g., SSH login) and verify the log appears in Kibana\u2019s dashboard.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">5. Real-World Use Cases<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Scenario 1: Detecting Unauthorized Access<\/h3>\n\n\n\n<p>A DevSecOps team monitors audit logs to identify unauthorized SSH login attempts on production servers. By analyzing <code>\/var\/log\/auth.log<\/code> in a SIEM tool, they detect repeated failed login attempts from a specific IP address and block it using a firewall rule.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Scenario 2: Compliance Auditing<\/h3>\n\n\n\n<p>A financial institution uses AWS CloudTrail to log all API calls in their AWS environment. These audit logs provide evidence for PCI DSS compliance, showing who accessed or modified sensitive resources like payment databases.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Scenario 3: Pipeline Security<\/h3>\n\n\n\n<p>In a CI\/CD pipeline, audit logs track all build and deployment actions. When a deployment fails, the team uses logs from GitHub Actions to trace the issue to an unauthorized configuration change made by a developer.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Industry-Specific Example: Healthcare<\/h3>\n\n\n\n<p>A hospital uses audit logs to track access to electronic health records (EHRs). By logging every access event in a SIEM system, they ensure HIPAA compliance and review logs for unauthorized access to patient data.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">6. Benefits &amp; Limitations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Key Advantages<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Transparency<\/strong>: Provides clear visibility into system and user activities.<\/li>\n\n\n\n<li><strong>Security<\/strong>: Enables proactive detection of threats and anomalies.<\/li>\n\n\n\n<li><strong>Compliance<\/strong>: Meets regulatory requirements like GDPR, HIPAA, and SOC 2.<\/li>\n\n\n\n<li><strong>Troubleshooting<\/strong>: Simplifies root cause analysis for incidents and failures.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common Challenges or Limitations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Volume<\/strong>: Large log volumes can overwhelm storage and analysis systems.<\/li>\n\n\n\n<li><strong>Complexity<\/strong>: Setting up and maintaining log systems requires expertise.<\/li>\n\n\n\n<li><strong>False Positives<\/strong>: SIEM tools may generate excessive alerts, leading to alert fatigue.<\/li>\n\n\n\n<li><strong>Cost<\/strong>: Storing and processing logs in cloud environments can be expensive.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Limitation<\/th><th>Mitigation Strategy<\/th><\/tr><\/thead><tbody><tr><td>High Volume &amp; Storage Costs<\/td><td>Use log rotation, compression, and TTL<\/td><\/tr><tr><td>Performance Overhead<\/td><td>Sample logs or log only critical events<\/td><\/tr><tr><td>Log Tampering Risks<\/td><td>Use append-only storage or WORM systems<\/td><\/tr><tr><td>Complex Correlation<\/td><td>Integrate with SIEM for cross-source analysis<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">7. Best Practices &amp; Recommendations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Security Tips<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use immutable logs to prevent tampering.<\/li>\n\n\n\n<li>Encrypt logs in transit (e.g., TLS) and at rest.<\/li>\n\n\n\n<li>Restrict access to log systems using role-based access control (RBAC).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Filter irrelevant logs at the source to reduce volume.<\/li>\n\n\n\n<li>Implement log rotation to manage storage efficiently.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Maintenance<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Regularly update log collectors and analysis tools.<\/li>\n\n\n\n<li>Monitor log system health to prevent downtime or data loss.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance Alignment<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Map audit logs to specific compliance requirements (e.g., SOC 2 controls).<\/li>\n\n\n\n<li>Retain logs for the required duration (e.g., 7 years for HIPAA).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Automation Ideas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Automate anomaly detection using machine learning algorithms.<\/li>\n\n\n\n<li>Integrate logs with alerting tools like PagerDuty for real-time notifications.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">8. Comparison with Alternatives<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Tool<\/th><th>Strengths<\/th><th>Weaknesses<\/th><th>Best Use Case<\/th><\/tr><\/thead><tbody><tr><td>ELK Stack<\/td><td>Open-source, scalable, customizable<\/td><td>Complex setup, resource-intensive<\/td><td>General-purpose logging<\/td><\/tr><tr><td>Splunk<\/td><td>Advanced analytics, user-friendly<\/td><td>Expensive, proprietary<\/td><td>Enterprise environments<\/td><\/tr><tr><td>AWS CloudTrail<\/td><td>Native AWS integration, compliance<\/td><td>Limited to AWS ecosystem<\/td><td>Cloud-native applications<\/td><\/tr><tr><td>Graylog<\/td><td>Open-source, easy to deploy<\/td><td>Limited advanced features<\/td><td>Small to medium teams<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">When to Choose Audit Logs<\/h3>\n\n\n\n<p>Choose audit logs when compliance, security, or detailed activity tracking is critical. For non-sensitive environments, basic application logs or monitoring tools may suffice.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">9. Conclusion<\/h2>\n\n\n\n<p>Audit logs are a cornerstone of DevSecOps, providing visibility, security, and compliance across the software development lifecycle. As DevSecOps evolves, expect advancements in AI-driven log analysis and automation to enhance threat detection and incident response. <\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>1. Introduction &amp; Overview What are Audit Logs? Audit logs are detailed, chronological records of events and activities within a system. They capture who performed an action, what action was taken, when it occurred, and where it happened (e.g., which resource or service). In DevSecOps, audit logs are essential for tracking user actions, system events, &#8230; <a title=\"A Comprehensive Tutorial on Audit Logs in DevSecOps\" class=\"read-more\" href=\"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/\" aria-label=\"Read more about A Comprehensive Tutorial on Audit Logs in DevSecOps\">Read more<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-333","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>A Comprehensive Tutorial on Audit Logs in DevSecOps - FinOps School<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"A Comprehensive Tutorial on Audit Logs in DevSecOps - FinOps School\" \/>\n<meta property=\"og:description\" content=\"1. Introduction &amp; Overview What are Audit Logs? Audit logs are detailed, chronological records of events and activities within a system. They capture who performed an action, what action was taken, when it occurred, and where it happened (e.g., which resource or service). In DevSecOps, audit logs are essential for tracking user actions, system events, ... Read more\" \/>\n<meta property=\"og:url\" content=\"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/\" \/>\n<meta property=\"og:site_name\" content=\"FinOps School\" \/>\n<meta property=\"article:published_time\" content=\"2025-05-31T07:12:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-31T10:58:40+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_oin77goin77goin7-1024x1024.png\" \/>\n<meta name=\"author\" content=\"priteshgeek\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"priteshgeek\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/\",\"url\":\"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/\",\"name\":\"A Comprehensive Tutorial on Audit Logs in DevSecOps - FinOps School\",\"isPartOf\":{\"@id\":\"https:\/\/finopsschool.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_oin77goin77goin7-1024x1024.png\",\"datePublished\":\"2025-05-31T07:12:37+00:00\",\"dateModified\":\"2025-05-31T10:58:40+00:00\",\"author\":{\"@id\":\"https:\/\/finopsschool.com\/blog\/#\/schema\/person\/a51d0791fd3a1d6d8e24354ec5f0f671\"},\"breadcrumb\":{\"@id\":\"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/#primaryimage\",\"url\":\"https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_oin77goin77goin7.png\",\"contentUrl\":\"https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_oin77goin77goin7.png\",\"width\":2048,\"height\":2048},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/finopsschool.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"A Comprehensive Tutorial on Audit Logs in DevSecOps\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/finopsschool.com\/blog\/#website\",\"url\":\"https:\/\/finopsschool.com\/blog\/\",\"name\":\"FinOps School\",\"description\":\"FinOps NoOps Certifications\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/finopsschool.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/finopsschool.com\/blog\/#\/schema\/person\/a51d0791fd3a1d6d8e24354ec5f0f671\",\"name\":\"priteshgeek\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/finopsschool.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/231a0e8b7a02636f2fbacf8dcf4494cb1cc0d49ecc9a8165fbaeaeeaf102641a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/231a0e8b7a02636f2fbacf8dcf4494cb1cc0d49ecc9a8165fbaeaeeaf102641a?s=96&d=mm&r=g\",\"caption\":\"priteshgeek\"},\"url\":\"https:\/\/finopsschool.com\/blog\/author\/priteshgeek\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"A Comprehensive Tutorial on Audit Logs in DevSecOps - FinOps School","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/","og_locale":"en_US","og_type":"article","og_title":"A Comprehensive Tutorial on Audit Logs in DevSecOps - FinOps School","og_description":"1. Introduction &amp; Overview What are Audit Logs? Audit logs are detailed, chronological records of events and activities within a system. They capture who performed an action, what action was taken, when it occurred, and where it happened (e.g., which resource or service). In DevSecOps, audit logs are essential for tracking user actions, system events, ... Read more","og_url":"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/","og_site_name":"FinOps School","article_published_time":"2025-05-31T07:12:37+00:00","article_modified_time":"2025-05-31T10:58:40+00:00","og_image":[{"url":"https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_oin77goin77goin7-1024x1024.png","type":"","width":"","height":""}],"author":"priteshgeek","twitter_card":"summary_large_image","twitter_misc":{"Written by":"priteshgeek","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/","url":"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/","name":"A Comprehensive Tutorial on Audit Logs in DevSecOps - FinOps School","isPartOf":{"@id":"https:\/\/finopsschool.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/#primaryimage"},"image":{"@id":"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/#primaryimage"},"thumbnailUrl":"https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_oin77goin77goin7-1024x1024.png","datePublished":"2025-05-31T07:12:37+00:00","dateModified":"2025-05-31T10:58:40+00:00","author":{"@id":"https:\/\/finopsschool.com\/blog\/#\/schema\/person\/a51d0791fd3a1d6d8e24354ec5f0f671"},"breadcrumb":{"@id":"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/#primaryimage","url":"https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_oin77goin77goin7.png","contentUrl":"https:\/\/finopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/Gemini_Generated_Image_oin77goin77goin7.png","width":2048,"height":2048},{"@type":"BreadcrumbList","@id":"https:\/\/finopsschool.com\/blog\/a-comprehensive-tutorial-on-audit-logs-in-devsecops\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/finopsschool.com\/blog\/"},{"@type":"ListItem","position":2,"name":"A Comprehensive Tutorial on Audit Logs in DevSecOps"}]},{"@type":"WebSite","@id":"https:\/\/finopsschool.com\/blog\/#website","url":"https:\/\/finopsschool.com\/blog\/","name":"FinOps School","description":"FinOps NoOps Certifications","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/finopsschool.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/finopsschool.com\/blog\/#\/schema\/person\/a51d0791fd3a1d6d8e24354ec5f0f671","name":"priteshgeek","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/finopsschool.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/231a0e8b7a02636f2fbacf8dcf4494cb1cc0d49ecc9a8165fbaeaeeaf102641a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/231a0e8b7a02636f2fbacf8dcf4494cb1cc0d49ecc9a8165fbaeaeeaf102641a?s=96&d=mm&r=g","caption":"priteshgeek"},"url":"https:\/\/finopsschool.com\/blog\/author\/priteshgeek\/"}]}},"_links":{"self":[{"href":"https:\/\/finopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/finopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/finopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/finopsschool.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/finopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=333"}],"version-history":[{"count":3,"href":"https:\/\/finopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/333\/revisions"}],"predecessor-version":[{"id":378,"href":"https:\/\/finopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/333\/revisions\/378"}],"wp:attachment":[{"href":"https:\/\/finopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/finopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/finopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}