`AU-03` Content of Audit Records

NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version

first version loaded AU Low baseline Moderate baseline High baseline

Title

Content of Audit Records

Control

Ensure that audit records contain information that establishes the following:
a. What type of event occurred;
b. When the event occurred;
c. Where the event occurred;
d. Source of the event;
e. Outcome of the event; and
f. Identity of any individuals, subjects, or objects/entities associated with the event.

Discussion

Audit record content that may be necessary to support the auditing function includes event descriptions (item a), time stamps (item b), source and destination addresses (item c), user or process identifiers (items d and f), success or fail indications (item e), and filenames involved (items a, c, e, and f) . Event outcomes include indicators of event success or failure and event-specific results, such as the system security and privacy posture after the event occurred. Organizations consider how audit records can reveal information about individuals that may give rise to privacy risks and how best to mitigate such risks. For example, there is the potential to reveal personally identifiable information in the audit trail, especially if the trail records inputs or is based on patterns or time of usage.

Related controls

au-12, au-14, au-2, au-8, ma-4, pl-9, sa-8, si-11, si-7

STIG rules that implement this control 127

Apple macOS 15 (Sequoia) V1R8

APPL-15-001003 CAT II The macOS system must enable security auditing.

Apple macOS 26 (Tahoe) V1R4

APPL-26-001003 CAT II The macOS system must enable security auditing.

Application Security and Development V6R5

APSC-DV-000940 CAT II The application must log application shutdown events.
APSC-DV-000950 CAT II The application must log destination IP addresses.
APSC-DV-000960 CAT II The application must log user actions involving access to data.
APSC-DV-000970 CAT II The application must log user actions involving changes to data.
APSC-DV-000980 CAT II The application must produce audit records containing information to establish when (date and time) the events occurred.
APSC-DV-000990 CAT II The application must produce audit records containing enough information to establish which component, feature or function of the application triggered the audit event.
APSC-DV-001000 CAT II When using centralized logging; the application must include a unique identifier in order to distinguish itself from other application logs.
APSC-DV-001010 CAT II The application must produce audit records that contain information to establish the outcome of the events.
APSC-DV-001020 CAT II The application must generate audit records containing information that establishes the identity of any individual or process associated with the event.

Canonical Ubuntu 22.04 LTS V2R10

UBTU-22-653010 CAT II Ubuntu 22.04 LTS must have the "auditd" package installed.
UBTU-22-653015 CAT II Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.

Canonical Ubuntu 24.04 LTS V1R7

UBTU-24-100400 CAT II Ubuntu 24.04 LTS must have the "auditd" package installed.
UBTU-24-100410 CAT II Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.

Cisco IOS XE Router NDM Y26M04

CISC-ND-000280 CAT II The Cisco router must produce audit records containing information to establish when (date and time) the events occurred.
CISC-ND-000290 CAT II The Cisco router must produce audit records containing information to establish where the events occurred.

Microsoft Windows 11 V2R11

WN11-AU-000555 CAT II Windows 11 must be configured to audit Other Policy Change Events Failures.
WN11-AU-000560 CAT II Windows 11 must be configured to audit other Logon/Logoff Events Successes.
WN11-AU-000565 CAT II Windows 11 must be configured to audit other Logon/Logoff Events Failures.
WN11-AU-000570 CAT II Windows 11 must be configured to audit Detailed File Share Failures.
WN11-AU-000575 CAT II Windows 11 must be configured to audit MPSSVC Rule-Level Policy Change Successes.
WN11-AU-000580 CAT II Windows 11 must be configured to audit MPSSVC Rule-Level Policy Change Failures.
WN11-CC-000327 CAT II PowerShell Transcription must be enabled on Windows 11.

Microsoft Windows Server 2022 V2R11

WN22-CC-000530 CAT II Windows Server 2022 must have PowerShell Transcription enabled.

Red Hat Enterprise Linux 10 V1R3

RHEL-10-200641 CAT II RHEL 10 must have the rsyslog service set to active.
RHEL-10-200648 CAT II RHEL 10 must use cron logging.
RHEL-10-200660 CAT II RHEL 10 must have the "audit" package installed.
RHEL-10-200661 CAT II RHEL 10 must enable the audit service.
RHEL-10-500030 CAT II RHEL 10 must allocate an "audit_backlog_limit" of sufficient size to capture processes that start prior to the audit daemon.
RHEL-10-500045 CAT II RHEL 10 must label all off-loaded audit logs before sending them to the central log server.
RHEL-10-500120 CAT II RHEL 10 must produce audit records containing information to establish the identity of any individual or process associated with the event.
RHEL-10-500310 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls.
RHEL-10-500320 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of "umount" system calls.
RHEL-10-500330 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "chacl" command.
RHEL-10-500340 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "setfacl" command.
RHEL-10-500350 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "chcon" command.
RHEL-10-500360 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "semanage" command.
RHEL-10-500370 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "setfiles" command.
RHEL-10-500380 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "setsebool" command.
RHEL-10-500390 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls.
RHEL-10-500400 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "delete_module" system call.
RHEL-10-500410 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "init_module" and "finit_module" system calls.
RHEL-10-500420 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "chage" command.
RHEL-10-500430 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "chsh" command.
RHEL-10-500440 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "crontab" command.
RHEL-10-500450 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "gpasswd" command.
RHEL-10-500460 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "kmod" command.
RHEL-10-500470 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "newgrp" command.
RHEL-10-500480 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "pam_timestamp_check" command.
RHEL-10-500490 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "passwd" command.
RHEL-10-500500 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "postdrop" command.
RHEL-10-500510 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "postqueue" command.
RHEL-10-500520 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the ssh-agent command.
RHEL-10-500530 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "ssh-keysign" command.
RHEL-10-500540 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "su" command.
RHEL-10-500550 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "sudo" command.
RHEL-10-500560 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "sudoedit" command.
RHEL-10-500570 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "unix_chkpwd" command.
RHEL-10-500580 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "unix_update" command.
RHEL-10-500590 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "userhelper" command.
RHEL-10-500600 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "usermod" command.
RHEL-10-500605 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "useradd" command.
RHEL-10-500610 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "mount" command.
RHEL-10-500660 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "umount" system call.
RHEL-10-500670 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "umount2" system call.
RHEL-10-500680 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
RHEL-10-500690 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect the "/etc/sudoers.d/" directory.
RHEL-10-500700 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group".
RHEL-10-500710 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow".
RHEL-10-500720 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd".
RHEL-10-500730 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd".
RHEL-10-500740 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow".
RHEL-10-500760 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/lastlog".
RHEL-10-500780 CAT II RHEL 10 must generate audit records for all uses of the "chmod", "fchmod", "fchmodat", and "fchmodat2" syscalls.
RHEL-10-500790 CAT II RHEL 10 must generate audit records for all uses of the "chown", "fchown", "fchownat", and "lchown" syscalls.
RHEL-10-500810 CAT II RHEL 10 must generate audit records for all uses of the "rename", "unlink", "rmdir", "renameat", "renameat2", and "unlinkat" system calls.

Red Hat Enterprise Linux 9 V2R10

RHEL-09-212055 CAT III RHEL 9 must enable auditing of processes that start prior to the audit daemon.
RHEL-09-653010 CAT II RHEL 9 audit package must be installed.
RHEL-09-653015 CAT II RHEL 9 audit service must be enabled.
RHEL-09-653060 CAT II RHEL 9 must label all offloaded audit logs before sending them to the central log server.
RHEL-09-653100 CAT II RHEL 9 must produce audit records containing information to establish the identity of any individual or process associated with the event.
RHEL-09-654015 CAT II RHEL 9 must audit all uses of the chmod, fchmod, and fchmodat system calls.
RHEL-09-654020 CAT II RHEL 9 must audit all uses of the chown, fchown, fchownat, and lchown system calls.
RHEL-09-654025 CAT II RHEL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
RHEL-09-654030 CAT II RHEL 9 must audit all uses of umount system calls.
RHEL-09-654035 CAT II RHEL 9 must audit all uses of the chacl command.
RHEL-09-654040 CAT II RHEL 9 must audit all uses of the setfacl command.
RHEL-09-654045 CAT II RHEL 9 must audit all uses of the chcon command.
RHEL-09-654050 CAT II RHEL 9 must audit all uses of the semanage command.
RHEL-09-654055 CAT II RHEL 9 must audit all uses of the setfiles command.
RHEL-09-654060 CAT II RHEL 9 must audit all uses of the setsebool command.
RHEL-09-654065 CAT II RHEL 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.
RHEL-09-654070 CAT II RHEL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
RHEL-09-654075 CAT II RHEL 9 must audit all uses of the delete_module system call.
RHEL-09-654080 CAT II RHEL 9 must audit all uses of the init_module and finit_module system calls.
RHEL-09-654085 CAT II RHEL 9 must audit all uses of the chage command.
RHEL-09-654090 CAT II RHEL 9 must audit all uses of the chsh command.
RHEL-09-654095 CAT II RHEL 9 must audit all uses of the crontab command.
RHEL-09-654100 CAT II RHEL 9 must audit all uses of the gpasswd command.
RHEL-09-654105 CAT II RHEL 9 must audit all uses of the kmod command.
RHEL-09-654110 CAT II RHEL 9 must audit all uses of the newgrp command.
RHEL-09-654115 CAT II RHEL 9 must audit all uses of the pam_timestamp_check command.
RHEL-09-654120 CAT II RHEL 9 must audit all uses of the passwd command.
RHEL-09-654125 CAT II RHEL 9 must audit all uses of the postdrop command.
RHEL-09-654130 CAT II RHEL 9 must audit all uses of the postqueue command.
RHEL-09-654135 CAT II RHEL 9 must audit all uses of the ssh-agent command.
RHEL-09-654140 CAT II RHEL 9 must audit all uses of the ssh-keysign command.
RHEL-09-654145 CAT II RHEL 9 must audit all uses of the su command.
RHEL-09-654150 CAT II RHEL 9 must audit all uses of the sudo command.
RHEL-09-654155 CAT II RHEL 9 must audit all uses of the sudoedit command.
RHEL-09-654160 CAT II RHEL 9 must audit all uses of the unix_chkpwd command.
RHEL-09-654165 CAT II RHEL 9 must audit all uses of the unix_update command.
RHEL-09-654170 CAT II RHEL 9 must audit all uses of the userhelper command.
RHEL-09-654175 CAT II RHEL 9 must audit all uses of the usermod command.
RHEL-09-654176 CAT II RHEL 9 must audit all uses of the useradd command.
RHEL-09-654180 CAT II RHEL 9 must audit all uses of the mount command.
RHEL-09-654205 CAT II Successful/unsuccessful uses of the umount system call in RHEL 9 must generate an audit record.
RHEL-09-654210 CAT II Successful/unsuccessful uses of the umount2 system call in RHEL 9 must generate an audit record.
RHEL-09-654215 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
RHEL-09-654220 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/directory.
RHEL-09-654225 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
RHEL-09-654230 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
RHEL-09-654235 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
RHEL-09-654240 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
RHEL-09-654245 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
RHEL-09-654255 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.

AU-03 Content of Audit Records