A chronological set of logs and records used to provide evidence of a system's performance or personnel activity that took place on the system and used to detect and identify intruders.