AU-06(04) Central Review and Analysis
NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
All changes in this version
Title
Central Review and Analysis
Control
Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.
Discussion
Automated mechanisms for centralized reviews and analyses include Security Information and Event Management products.
Related controls
au-12, au-2
STIG rules that implement this control 18
Apple macOS 15 (Sequoia) V1R8
- APPL-15-005001 CAT I The macOS system must ensure System Integrity Protection is enabled.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-005001 CAT I The macOS system must ensure System Integrity Protection (SIP) is enabled.
Application Security and Development V6R5
- APSC-DV-001050 CAT II The application must provide centralized management and configuration of the content to be captured in audit records generated by all application components.
- APSC-DV-001130 CAT II The application must provide the capability to centrally review and analyze audit records from multiple components within the system.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-653010 CAT II Ubuntu 22.04 LTS must have the "auditd" package installed.
- UBTU-22-653015 CAT II Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100400 CAT II Ubuntu 24.04 LTS must have the "auditd" package installed.
- UBTU-24-100410 CAT II Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.
Google Android 16 COBO Y26M10
- GOOG-16-002800 CAT II Google Android 16 must be configured to enable audit logging.
Google Android 17 COBO Y26M06
- GOOG-17-006600 CAT II Google Android 17 must be configured to enable audit logging.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200640 CAT II RHEL 10 must have the "rsyslog" package installed.
- RHEL-10-200660 CAT II RHEL 10 must have the "audit" package installed.
- RHEL-10-200661 CAT II RHEL 10 must enable the audit service.
- RHEL-10-500125 CAT II RHEL 10 must periodically flush audit records to disk to ensure that audit records are not lost.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-652010 CAT II RHEL 9 must have the rsyslog package installed.
- RHEL-09-653010 CAT II RHEL 9 audit package must be installed.
- RHEL-09-653015 CAT II RHEL 9 audit service must be enabled.
- RHEL-09-653095 CAT II RHEL 9 must periodically flush audit records to disk to prevent the loss of audit records.