To Know:
•WHAT IT IS?
•WHY WE NEED
•WHAT CAN WE AUDIT
•WHAT ORACLE AUDITS ON Its OWN
•WHERE AUDIT DATA ARE KEPT
•HOW TO SET CUSTOM AUDIT
•HOW TO SEE WHAT AUDITS ARE SET
•HOW TO SEE THE AUDIT TRAIL
Check:
https://docs.oracle.com/cd/E11882_01/server.112/e10575/tdpsg_auditing.htm#TDPSG50511
Activity: Using Audit Trail Views to Investigate Suspicious Activities
https://docs.oracle.com/cd/B19306_01/network.102/b14266/cfgaudit.htm#i1010026