Three properties do the work in most descriptions of a blockchain, and each is a matter of degree rather than an absolute.
The first is that the record is distributed. Instead of one institution holding the authoritative copy, many participants each hold a copy, and the network follows a set of rules to keep those copies in agreement. This is why a blockchain is often called decentralized, but decentralization describes the protocol, not necessarily the ownership of the assets on it or the concentration of the parties who actually run the network. A blockchain can be technically distributed while most of its activity flows through a small number of large operators.
The second is that it is append-only and hard to alter after the fact. Each block contains a cryptographic fingerprint, called a hash, of the block before it. Changing an old block would change its hash, which would break the link to every block that came after, so tampering with a settled record would require redoing all the work that followed it and convincing the rest of the network to accept the altered version. This is what people mean when they call a blockchain immutable. It is more accurate to say that rewriting history is designed to be prohibitively expensive rather than impossible.
The third is consensus: the method by which the network agrees on which new block is valid. The two best-known methods are proof of work, where participants compete by expending computing power, and proof of stake, where participants are chosen to validate blocks in proportion to the assets they commit as collateral. Bitcoin uses proof of work; Ethereum moved to proof of stake. The consensus method determines who gets to add the next block, how the network is secured, and how much energy the whole system consumes.
A further split is public versus private. A public, or permissionless, blockchain lets anyone read the ledger and participate in validating it, which is the model behind bitcoin and most cryptocurrencies. A private, or permissioned, blockchain restricts who can join, and is closer to a shared database run by a defined group of organizations. The word "blockchain" alone does not tell you which of these you are looking at, and the security and transparency claims that hold for a large public chain do not automatically carry over to a small permissioned one.