What is the primary purpose of audit logs in Annex F?

• A. To replace incident response processes.
• B. To detect, investigate, and verify events.
• C. To disable monitoring.
• D. To improve user interface.

Answer: (B)

Audit logs provide visibility into system activity by recording events with details like who did what, when, and on which resources. The main purpose here is to detect unusual or unauthorized activity, investigate what happened by tracing the exact sequence of events, and verify the occurrence and scope of those events. This creates a reliable evidence trail that helps identify incidents, understand their impact, and support containment, remediation, and compliance efforts. Audit logs feed into detection and investigation processes rather than replacing them, and they don’t serve to disable monitoring or change the user experience.