BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

APSC-DV-000850 The application must generate audit records showing starting and ending time for user access to the system.

DISA STIG library V6R5
All changes in this version
first version loaded CAT II

Maps to AU-12 via CCI-000172

Title

The application must generate audit records showing starting and ending time for user access to the system.

Control

Review and monitor the application logs. Initiate a user session and observe if the log includes a time stamp showing the start of the session. Terminate the user session and observe if the log includes a time stamp showing the end of the session. If the start and the end time of the session are not recorded in the logs, this is a finding.

Discussion

Knowing when a user’s application session began and when it ended is critical information that aids in forensic analysis.

Related controls

CCI-000172

Fix

Configure the application or application server to record the start and end time of user session activity.