{
  "id": "audit-capabilities",
  "title": "Cloud audit-logging capabilities",
  "description": "Nine audit-logging features — scope, identity, request metadata, data-plane events, search, retention, export, integrity, pricing — per provider.",
  "version": "1.0",
  "updatedAt": "2026-11-06",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "publisher": "Cloud Provider Benchmarks",
  "url": "https://www.cloudproviderbenchmarks.com/datasets/audit-capabilities/",
  "columns": [
    {
      "key": "provider",
      "description": "Provider id"
    },
    {
      "key": "product",
      "description": "Audit-logging product"
    },
    {
      "key": "feature",
      "description": "Audit feature id"
    },
    {
      "key": "value",
      "description": "yes | partial | planned | no | unverified"
    },
    {
      "key": "note",
      "description": "Qualifying note (English)"
    },
    {
      "key": "source_type",
      "description": "official-docs | first-party | publisher-supplied"
    },
    {
      "key": "source",
      "description": "Source URL"
    }
  ],
  "rows": [
    {
      "provider": "portvmind-cloud",
      "product": "vTrail",
      "feature": "scope",
      "value": "yes",
      "note": "Cloud management API operations.",
      "source_type": "publisher-supplied",
      "source": "https://portvmind.com"
    },
    {
      "provider": "portvmind-cloud",
      "product": "vTrail",
      "feature": "identity",
      "value": "yes",
      "note": "User ID, user name, project ID and auth scope.",
      "source_type": "publisher-supplied",
      "source": "https://portvmind.com"
    },
    {
      "provider": "portvmind-cloud",
      "product": "vTrail",
      "feature": "request-metadata",
      "value": "yes",
      "note": "Request ID, HTTP method, path, status, client IP, user agent, request time.",
      "source_type": "publisher-supplied",
      "source": "https://portvmind.com"
    },
    {
      "provider": "portvmind-cloud",
      "product": "vTrail",
      "feature": "data-plane",
      "value": "unverified",
      "note": null,
      "source_type": "publisher-supplied",
      "source": "https://portvmind.com"
    },
    {
      "provider": "portvmind-cloud",
      "product": "vTrail",
      "feature": "search",
      "value": "unverified",
      "note": null,
      "source_type": "publisher-supplied",
      "source": "https://portvmind.com"
    },
    {
      "provider": "portvmind-cloud",
      "product": "vTrail",
      "feature": "retention",
      "value": "unverified",
      "note": null,
      "source_type": "publisher-supplied",
      "source": "https://portvmind.com"
    },
    {
      "provider": "portvmind-cloud",
      "product": "vTrail",
      "feature": "export",
      "value": "unverified",
      "note": null,
      "source_type": "publisher-supplied",
      "source": "https://portvmind.com"
    },
    {
      "provider": "portvmind-cloud",
      "product": "vTrail",
      "feature": "integrity",
      "value": "unverified",
      "note": null,
      "source_type": "publisher-supplied",
      "source": "https://portvmind.com"
    },
    {
      "provider": "portvmind-cloud",
      "product": "vTrail",
      "feature": "pricing",
      "value": "unverified",
      "note": null,
      "source_type": "publisher-supplied",
      "source": "https://portvmind.com"
    },
    {
      "provider": "aws",
      "product": "AWS CloudTrail",
      "feature": "scope",
      "value": "yes",
      "note": "Management events recorded by default.",
      "source_type": "official-docs",
      "source": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html"
    },
    {
      "provider": "aws",
      "product": "AWS CloudTrail",
      "feature": "identity",
      "value": "yes",
      "note": "userIdentity block (principal, account, session).",
      "source_type": "official-docs",
      "source": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html"
    },
    {
      "provider": "aws",
      "product": "AWS CloudTrail",
      "feature": "request-metadata",
      "value": "yes",
      "note": "eventTime, requestID, sourceIPAddress, userAgent, errorCode.",
      "source_type": "official-docs",
      "source": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html"
    },
    {
      "provider": "aws",
      "product": "AWS CloudTrail",
      "feature": "data-plane",
      "value": "yes",
      "note": "Data events (for example S3 object-level) are optional and charged.",
      "source_type": "official-docs",
      "source": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html"
    },
    {
      "provider": "aws",
      "product": "AWS CloudTrail",
      "feature": "search",
      "value": "yes",
      "note": "Event history lookup; SQL queries in CloudTrail Lake.",
      "source_type": "official-docs",
      "source": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html"
    },
    {
      "provider": "aws",
      "product": "AWS CloudTrail",
      "feature": "retention",
      "value": "yes",
      "note": "90-day event history; longer retention via trails to S3 or CloudTrail Lake.",
      "source_type": "official-docs",
      "source": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html"
    },
    {
      "provider": "aws",
      "product": "AWS CloudTrail",
      "feature": "export",
      "value": "yes",
      "note": "S3, CloudWatch Logs, EventBridge.",
      "source_type": "official-docs",
      "source": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html"
    },
    {
      "provider": "aws",
      "product": "AWS CloudTrail",
      "feature": "integrity",
      "value": "yes",
      "note": "Log file integrity validation with digest files.",
      "source_type": "official-docs",
      "source": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html"
    },
    {
      "provider": "aws",
      "product": "AWS CloudTrail",
      "feature": "pricing",
      "value": "yes",
      "note": "Event history and one copy of management events free; data events and Lake charged.",
      "source_type": "official-docs",
      "source": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html"
    },
    {
      "provider": "microsoft-azure",
      "product": "Azure Monitor Activity Log",
      "feature": "scope",
      "value": "yes",
      "note": "Azure Resource Manager write/delete/action operations.",
      "source_type": "official-docs",
      "source": "https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log"
    },
    {
      "provider": "microsoft-azure",
      "product": "Azure Monitor Activity Log",
      "feature": "identity",
      "value": "yes",
      "note": "Caller and claims.",
      "source_type": "official-docs",
      "source": "https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log"
    },
    {
      "provider": "microsoft-azure",
      "product": "Azure Monitor Activity Log",
      "feature": "request-metadata",
      "value": "partial",
      "note": "Correlation ID, operation, status and caller IP in HTTP request details where available.",
      "source_type": "official-docs",
      "source": "https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log"
    },
    {
      "provider": "microsoft-azure",
      "product": "Azure Monitor Activity Log",
      "feature": "data-plane",
      "value": "partial",
      "note": "Via resource logs and diagnostic settings, not the Activity Log itself.",
      "source_type": "official-docs",
      "source": "https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log"
    },
    {
      "provider": "microsoft-azure",
      "product": "Azure Monitor Activity Log",
      "feature": "search",
      "value": "yes",
      "note": "Portal filtering and Log Analytics (KQL).",
      "source_type": "official-docs",
      "source": "https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log"
    },
    {
      "provider": "microsoft-azure",
      "product": "Azure Monitor Activity Log",
      "feature": "retention",
      "value": "yes",
      "note": "90 days in the platform; longer through Log Analytics or Storage.",
      "source_type": "official-docs",
      "source": "https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log"
    },
    {
      "provider": "microsoft-azure",
      "product": "Azure Monitor Activity Log",
      "feature": "export",
      "value": "yes",
      "note": "Diagnostic settings to Log Analytics, Storage and Event Hubs.",
      "source_type": "official-docs",
      "source": "https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log"
    },
    {
      "provider": "microsoft-azure",
      "product": "Azure Monitor Activity Log",
      "feature": "integrity",
      "value": "partial",
      "note": "Immutable storage policies on the export destination.",
      "source_type": "official-docs",
      "source": "https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log"
    },
    {
      "provider": "microsoft-azure",
      "product": "Azure Monitor Activity Log",
      "feature": "pricing",
      "value": "yes",
      "note": "90-day Activity Log included; ingestion into Log Analytics is charged.",
      "source_type": "official-docs",
      "source": "https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log"
    },
    {
      "provider": "google-cloud",
      "product": "Cloud Audit Logs",
      "feature": "scope",
      "value": "yes",
      "note": "Admin Activity logs always enabled.",
      "source_type": "official-docs",
      "source": "https://cloud.google.com/logging/docs/audit"
    },
    {
      "provider": "google-cloud",
      "product": "Cloud Audit Logs",
      "feature": "identity",
      "value": "yes",
      "note": "authenticationInfo.principalEmail.",
      "source_type": "official-docs",
      "source": "https://cloud.google.com/logging/docs/audit"
    },
    {
      "provider": "google-cloud",
      "product": "Cloud Audit Logs",
      "feature": "request-metadata",
      "value": "yes",
      "note": "requestMetadata.callerIp and callerSuppliedUserAgent; status.",
      "source_type": "official-docs",
      "source": "https://cloud.google.com/logging/docs/audit"
    },
    {
      "provider": "google-cloud",
      "product": "Cloud Audit Logs",
      "feature": "data-plane",
      "value": "yes",
      "note": "Data Access logs, mostly disabled by default.",
      "source_type": "official-docs",
      "source": "https://cloud.google.com/logging/docs/audit"
    },
    {
      "provider": "google-cloud",
      "product": "Cloud Audit Logs",
      "feature": "search",
      "value": "yes",
      "note": "Logs Explorer and Log Analytics.",
      "source_type": "official-docs",
      "source": "https://cloud.google.com/logging/docs/audit"
    },
    {
      "provider": "google-cloud",
      "product": "Cloud Audit Logs",
      "feature": "retention",
      "value": "yes",
      "note": "Admin Activity retained 400 days in _Required; other buckets configurable.",
      "source_type": "official-docs",
      "source": "https://cloud.google.com/logging/docs/audit"
    },
    {
      "provider": "google-cloud",
      "product": "Cloud Audit Logs",
      "feature": "export",
      "value": "yes",
      "note": "Sinks to Cloud Storage, BigQuery and Pub/Sub.",
      "source_type": "official-docs",
      "source": "https://cloud.google.com/logging/docs/audit"
    },
    {
      "provider": "google-cloud",
      "product": "Cloud Audit Logs",
      "feature": "integrity",
      "value": "partial",
      "note": "Locked log buckets prevent retention changes.",
      "source_type": "official-docs",
      "source": "https://cloud.google.com/logging/docs/audit"
    },
    {
      "provider": "google-cloud",
      "product": "Cloud Audit Logs",
      "feature": "pricing",
      "value": "yes",
      "note": "Admin Activity at no charge; Data Access ingestion charged beyond free allotment.",
      "source_type": "official-docs",
      "source": "https://cloud.google.com/logging/docs/audit"
    }
  ]
}