Detections
Analytics

1.10 EX19-MB-000033

Information

Exchange audit record parameters must be set.

GROUP ID: V-259654
RULE ID: SV-259654r960879

Log files help establish a history of activities and can be useful in detecting attack attempts. This item declares the fields that must be available in the audit log file to adequately research events that are logged.

Audit records should include the following fields to supply useful event accounting: Object modified, Cmdlet name, Cmdlet parameters, Modified parameters, Caller, Succeeded, and Originating server.

Solution

Open the Exchange Management Shell and enter the following command:

Set-AdminAuditLogConfig -AdminAuditLogParameters *

See Also

https://workbench.cisecurity.org/benchmarks/23653

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12a., CAT|III, CCI|CCI-000169, Rule-ID|SV-259654r960879_rule, STIG-ID|EX19-MB-000033, Vuln-ID|V-259654

Plugin: Windows

Control ID: ed6cd38773e833cd8def44f6f0d6db9ff3273f810cec978a5a51972a02e84dd3