AU-07(01) Automatic Processing
NIST SP 800-53 (controls) 5.2.0 against 5.1.1+u4
All changes in this version
All changes in this version
Title
Automatic Processing
Control
Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [Assignment: fields within audit records].
Discussion
Events of interest can be identified by the content of audit records, including system resources involved, information objects accessed, identities of individuals, event types, event locations, event dates and times, Internet Protocol addresses involved, or event success or failure. Organizations may define event criteria to any degree of granularity required, such as locations selectable by a general networking location or by specific system component.
Parameters
au-07.01_odp: fields within audit records
STIG rules that implement this control 11
Apple macOS 15 (Sequoia) V1R8
- APPL-15-005001 CAT I The macOS system must ensure System Integrity Protection is enabled.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-005001 CAT I The macOS system must ensure System Integrity Protection (SIP) is enabled.
Application Security and Development V6R5
- APSC-DV-001140 CAT II The application must provide the capability to filter audit records for events of interest based upon organization-defined criteria.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-653010 CAT II Ubuntu 22.04 LTS must have the "auditd" package installed.
- UBTU-22-653015 CAT II Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100400 CAT II Ubuntu 24.04 LTS must have the "auditd" package installed.
- UBTU-24-100410 CAT II Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200660 CAT II RHEL 10 must have the "audit" package installed.
- RHEL-10-200661 CAT II RHEL 10 must enable the audit service.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-653010 CAT II RHEL 9 audit package must be installed.
- RHEL-09-653015 CAT II RHEL 9 audit service must be enabled.