Glossary: Logs and Data Sources for Investigations

auid (audit user ID)

Also written: audit user ID

The field in an audit record that names the account that first signed in. It stays the same even if the person later switches accounts, so auid=sam points back to the original sign-in.