AU-05(02) Real-time Alerts
All changes in this version
Title
Real-time Alerts
Control
Provide an alert within [Assignment: real-time period] to [Assignment: personnel, roles, and/or locations] when the following audit failure events occur: [Assignment: audit logging failure events requiring real-time alerts].
Discussion
Alerts provide organizations with urgent messages. Real-time alerts provide these messages at information technology speed (i.e., the time from event detection to alert occurs in seconds or less).
Parameters
au-05.02_odp.01: real-time period
au-05.02_odp.02: personnel, roles, and/or locations
au-05.02_odp.03: audit logging failure events requiring real-time alerts
Assessment objective
AU-05(02) an alert is provided within [Assignment: real-time period] to [Assignment: personnel, roles, and/or locations] when [Assignment: audit logging failure events requiring real-time alerts] occur.
STIG rules that implement this control 4
Apple macOS 15 (Sequoia) V1R8
- APPL-15-001031 CAT II The macOS system must configure audit failure notification.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-001031 CAT II The macOS system must configure audit failure notification.
Application Security and Development V6R5
- APSC-DV-001100 CAT II Applications categorized as having a moderate or high impact must provide an immediate real-time alert to the SA and ISSO (at a minimum) for all audit failure events.
Cisco IOS XE Router NDM Y26M04
- CISC-ND-001000 CAT II The Cisco router must be configured to generate an alert for all audit failure events.