Detections
Analytics

MS.EXO.17.3v1 - Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).

Information

Increased log retention time gives an agency the necessary visibility to investigate incidents that occurred some time ago. OMB M-21-13, Appendix C, Table 5 specifically calls out Unified Audit Logs in the Cloud Azure log category.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

See the following implementation steps to
[create an audit retention policy](./defender.md#msdefender63v1-instructions)
for additional guidance.

`TLP:CLEAR`

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-11

Plugin: microsoft_azure

Control ID: 206361af430d10228c0c4eeb6af2f478b237a4ebe572838f095166a16dfd24f1