AU-07 Audit Record Reduction and Report Generation
All changes in this version
Title
Audit Record Reduction and Report Generation
Control
Provide and implement an audit record reduction and report generation capability that:
a. Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and
b. Does not alter the original content or time ordering of audit records.
Discussion
Audit record reduction is a process that manipulates collected audit log information and organizes it into a summary format that is more meaningful to analysts. Audit record reduction and report generation capabilities do not always emanate from the same system or from the same organizational entities that conduct audit logging activities. The audit record reduction capability includes modern data mining techniques with advanced data filters to identify anomalous behavior in audit records. The report generation capability provided by the system can generate customizable reports. Time ordering of audit records can be an issue if the granularity of the timestamp in the record is insufficient.
Related controls
ac-2, au-12, au-16, au-2, au-3, au-4, au-5, au-6, cm-5, ia-5, ir-4, pm-12, si-4
STIG rules that implement this control 18
Apple macOS 15 (Sequoia) V1R8
- APPL-15-005001 CAT I The macOS system must ensure System Integrity Protection is enabled.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-005001 CAT I The macOS system must ensure System Integrity Protection (SIP) is enabled.
Application Security and Development V6R5
- APSC-DV-001150 CAT II The application must provide an audit reduction capability that supports on-demand reporting requirements.
- APSC-DV-001160 CAT II The application must provide an audit reduction capability that supports on-demand audit review and analysis.
- APSC-DV-001170 CAT II The application must provide an audit reduction capability that supports after-the-fact investigations of security incidents.
- APSC-DV-001180 CAT II The application must provide a report generation capability that supports on-demand audit review and analysis.
- APSC-DV-001190 CAT II The application must provide a report generation capability that supports on-demand reporting requirements.
- APSC-DV-001200 CAT II The application must provide a report generation capability that supports after-the-fact investigations of security incidents.
- APSC-DV-001210 CAT II The application must provide an audit reduction capability that does not alter original content or time ordering of audit records.
- APSC-DV-001220 CAT II The application must provide a report generation capability that does not alter original content or time ordering of audit records.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-653010 CAT II Ubuntu 22.04 LTS must have the "auditd" package installed.
- UBTU-22-653015 CAT II Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100400 CAT II Ubuntu 24.04 LTS must have the "auditd" package installed.
- UBTU-24-100410 CAT II Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200660 CAT II RHEL 10 must have the "audit" package installed.
- RHEL-10-200661 CAT II RHEL 10 must enable the audit service.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-653010 CAT II RHEL 9 audit package must be installed.
- RHEL-09-653015 CAT II RHEL 9 audit service must be enabled.