System audit and evidence

Event categories

DES records user and administrator actions, domain, mailbox and permission changes, delegation, licence and module state, migration, mail flow, security and integration operations according to the current release.

Minimum data

A useful audit entry contains actor, event type, object type or ID, timestamp, result and details. For automated workers, the actor may be a service identity.

Investigation

1. Define the period and affected object.
2. Preserve message, job and domain identifiers.
3. Correlate user audit, system audit, trace and service logs.
4. Do not alter evidence before export or recording.
5. Document the conclusion and corrective action.

Audit shows what the system recorded. It must be retained according to policy and must not be edited manually.