Detections
Analytics

6.6 Ensure ALL Events are Audited

Information

This filter defines all events to be written to the audit log.

The filter must be configured to log all events, and the binding must be applied to all users, to ensure complete audit log coverage.

Solution

Create Log All Filter:

SELECT audit_log_filter_set_filter('log_all', '{ "filter": { "log": true } }');

Apply to all logins:

SELECT audit_log_filter_set_user('%', 'log_all');

Impact:

Logging all events can result in very large audit files. In the case where the database is extremely active, it may be more appropriate to be more selective when defining audit filters.

See Also

https://workbench.cisecurity.org/benchmarks/22687

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|6.3

Plugin: MySQLDB

Control ID: 19bf7375b60e5d6728f41b1b531ec2e24ec7d6a4c384ad9a1d70a33e11738ce3