Audit trails need two things working together: integrity (nothing alters the record) and confidentiality (only authorized people see it). Miss either one and the trail stops being useful evidence. New post covers the difference between audit logs and audit trails, seven types of audit trails organizations generate, and a seven-step framework for building trail protection in from the start. Read here: https://graylog.org/post/protection-of-the-audit-trail-involves-both-integrity-and-confidentiality/