Guidelines for performing application logs review
===

I am writing a guideline for reviewing video logs of application admin activities in the enterprise.

As part of regulatory requirements, all admin activities at both the application layer and OS layer are to be logged to allow traceability of any malicious activities conducted.

However, the challenge here is creating a guideline for users who need to review these logs. The guideline should broadly specify what actions are considered as malicious activities. Does anyone have any references you'd know of which I could refer to?

thanks.