Auditing is an crucial part of every Organization, Every Organization wants to monitor user logins and user activity for compliance and Security purpose. Salesforce Marketing cloud provides this feature called Audit Trail which allows security admin users to view Marketing Cloud access and activity records.

Marketing Cloud offers two types of Audit Trail

To Enable Audit Trail– User should have Marketing Cloud Security Administrator role or should have Administer Audit Logging and API Access permission.

In Setup, select Security | Security Settings | Audit Trail and check Enable Audit Logging Data Collection

NOTE: Audit Trail data is available only after enabling. Data logged before enabling is not available.

How to Retrieve Audit Trail Records

• Automation Studio data extracts
• REST API extracts

Automation Studio Data Extract

Create a Data Extract Activity

The extract activity extracts your audit data to prepare it for file transfer.
Create a Data Extract activity in Automation Studio, Provide the details and Select the Extract Type. Choose either Audit Trail Activity Log or Audit Trail Access Log.

Select Rolling Range or Specific Range and choose 30 days or 60 days. Basic Audit Trail allows 30 days of data and Advanced Audit Trail allows 60 days

Review the activity Summary and click Finish, repeat this task to create another audit trail task.

Create a File Transfer Activity

This activity transfers your audit data to the secure Safehouse which you can access via FTP.
Create File Transfer Activity in Automation studio and Manage File or Move a File From Safehouse.

Create an Automation

This automation runs the data extract and file extract activities, then sends your audit data to your secure Marketing Cloud Safehouse.
Build an automation in Automation Studio to run the activities and receive the audit reports.

Once the Automation Runs, Login to your FTP Account to access Audit Reports.

You’ll receive the Audit report of your Marketing cloud account like below.

For Audit Trail API documentation, see getSecurityEvents and getAuditEvents

To view available Action and Event Audit Logs, See Security Event Audit Log and Security Action Audit Log

Resources:
https://help.salesforce.com/articleView?id=mc_overview_audit_trail.htm&type=5