800-53|AU-7(1)

Title

AUTOMATIC PROCESSING

Description

The information system provides the capability to process audit records for events of interest based on [Assignment: organization-defined audit fields within audit records].

Supplemental

Events of interest can be identified by the content of specific audit record fields including, for example, identities of individuals, event types, event locations, event times, event dates, system resources involved, IP addresses involved, or information objects accessed. Organizations may define audit event criteria to any degree of granularity required, for example, locations selectable by general networking location (e.g., by network or subnetwork) or selectable by specific information system component.

Reference Item Details

Related: AU-12,AU-2

Category: AUDIT AND ACCOUNTABILITY

Parent Title: AUDIT REDUCTION AND REPORT GENERATION

Family: AUDIT AND ACCOUNTABILITY

Baseline Impact: MODERATE,HIGH

Audit Items

View all Reference Audit Items

NamePluginAudit Name
2.1 Ensure That Cloud Audit Logging Is Configured ProperlyGCPCIS Google Cloud Platform v3.0.0 L1
2.1.11 Ensure the spoofed domains report is reviewed weeklymicrosoft_azureCIS Microsoft 365 Foundations E5 L1 v3.0.0
2.1.12 Ensure the 'Restricted entities' report is reviewed weeklymicrosoft_azureCIS Microsoft 365 Foundations E3 L1 v3.0.0
2.1.13 Ensure all security threats in the Threat protection status report are reviewed at least weeklymicrosoft_azureCIS Microsoft 365 Foundations E3 L1 v3.0.0
2.3.1 Ensure the Account Provisioning Activity report is reviewed at least weeklymicrosoft_azureCIS Microsoft 365 Foundations E3 L1 v3.0.0
2.3.2 Ensure non-global administrator role group assignments are reviewed at least weeklymicrosoft_azureCIS Microsoft 365 Foundations E3 L1 v3.0.0
2.12 Ensure That Cloud DNS Logging Is Enabled for All VPC NetworksGCPCIS Google Cloud Platform v3.0.0 L1
3.1.2 Ensure user role group changes are reviewed at least weeklymicrosoft_azureCIS Microsoft 365 Foundations E3 L1 v3.0.0
3.2 Ensure CloudTrail log file validation is enabledamazon_awsCIS Amazon Web Services Foundations L2 3.0.0
3.7 Ensure proxies pass source IP informationUnixCIS NGINX Benchmark v2.0.1 L1 Proxy
3.7 Ensure proxies pass source IP informationUnixCIS NGINX Benchmark v2.0.1 L1 Loadbalancer
3.7 Ensure proxies pass source IP information - X-Real-IPUnixCIS NGINX Benchmark v2.0.1 L1 Loadbalancer
3.7 Ensure proxies pass source IP information - X-Real-IPUnixCIS NGINX Benchmark v2.0.1 L1 Proxy
4.1 Ensure unauthorized API calls are monitoredamazon_awsCIS Amazon Web Services Foundations L2 3.0.0
4.2 Ensure management console sign-in without MFA is monitoredamazon_awsCIS Amazon Web Services Foundations L1 3.0.0
4.3 Ensure usage of 'root' account is monitoredamazon_awsCIS Amazon Web Services Foundations L1 3.0.0
4.4 Ensure IAM policy changes are monitoredamazon_awsCIS Amazon Web Services Foundations L1 3.0.0
4.5 Ensure CloudTrail configuration changes are monitoredamazon_awsCIS Amazon Web Services Foundations L1 3.0.0
4.6 Ensure AWS Management Console authentication failures are monitoredamazon_awsCIS Amazon Web Services Foundations L2 3.0.0
4.7 Ensure disabling or scheduled deletion of customer created CMKs is monitoredamazon_awsCIS Amazon Web Services Foundations L2 3.0.0
4.8 Ensure S3 bucket policy changes are monitoredamazon_awsCIS Amazon Web Services Foundations L1 3.0.0
4.9 Ensure AWS Config configuration changes are monitoredamazon_awsCIS Amazon Web Services Foundations L2 3.0.0
4.10 Ensure security group changes are monitoredamazon_awsCIS Amazon Web Services Foundations L2 3.0.0
4.11 Ensure Network Access Control Lists (NACL) changes are monitoredamazon_awsCIS Amazon Web Services Foundations L2 3.0.0
4.12 Ensure changes to network gateways are monitoredamazon_awsCIS Amazon Web Services Foundations L1 3.0.0
4.13 Ensure route table changes are monitoredamazon_awsCIS Amazon Web Services Foundations L1 3.0.0
4.14 Ensure VPC changes are monitoredamazon_awsCIS Amazon Web Services Foundations L1 3.0.0
4.15 Ensure AWS Organizations changes are monitoredamazon_awsCIS Amazon Web Services Foundations L1 3.0.0
5.1.5.1 Ensure the Application Usage report is reviewed at least weeklymicrosoft_azureCIS Microsoft 365 Foundations E3 L1 v3.0.0
5.2.4.2 Ensure the self-service password reset activity report is reviewed at least weeklymicrosoft_azureCIS Microsoft 365 Foundations E3 L1 v3.0.0
5.2.6.1 Ensure the Azure AD 'Risky sign-ins' report is reviewed at least weeklymicrosoft_azureCIS Microsoft 365 Foundations E5 L1 v3.0.0
6.4.1 Ensure mail forwarding rules are reviewed at least weeklymicrosoft_azureCIS Microsoft 365 Foundations E3 L1 v3.0.0
AOSX-13-000240 - The macOS system must enable System Integrity Protection.UnixDISA STIG Apple Mac OSX 10.13 v2r5
AOSX-14-005001 - The macOS system must enable System Integrity Protection.UnixDISA STIG Apple Mac OSX 10.14 v2r6
AOSX-15-005001 - The macOS system must enable System Integrity Protection.UnixDISA STIG Apple Mac OSX 10.15 v1r10
APPL-11-005001 - The macOS system must enable System Integrity Protection.UnixDISA STIG Apple macOS 11 v1r5
APPL-11-005001 - The macOS system must enable System Integrity Protection.UnixDISA STIG Apple macOS 11 v1r8
APPL-12-005001 - The macOS system must enable System Integrity Protection.UnixDISA STIG Apple macOS 12 v1r8
APPL-13-005001 - The macOS system must enable System Integrity Protection.UnixDISA STIG Apple macOS 13 v1r3
Big Sur - Audit Record Reduction and Report Generation - processingUnixNIST macOS Big Sur v1.4.0 - 800-53r5 High
Big Sur - Audit Record Reduction and Report Generation - processingUnixNIST macOS Big Sur v1.4.0 - 800-53r4 High
Big Sur - Audit Record Reduction and Report Generation - processingUnixNIST macOS Big Sur v1.4.0 - 800-53r5 Moderate
Big Sur - Audit Record Reduction and Report Generation - processingUnixNIST macOS Big Sur v1.4.0 - All Profiles
Big Sur - Ensure System Integrity Protection is EnabledUnixNIST macOS Big Sur v1.4.0 - CNSSI 1253
Big Sur - Ensure System Integrity Protection is EnabledUnixNIST macOS Big Sur v1.4.0 - 800-171
Big Sur - Ensure System Integrity Protection is EnabledUnixNIST macOS Big Sur v1.4.0 - 800-53r4 Low
Big Sur - Ensure System Integrity Protection is EnabledUnixNIST macOS Big Sur v1.4.0 - 800-53r4 Moderate
Big Sur - Ensure System Integrity Protection is EnabledUnixNIST macOS Big Sur v1.4.0 - 800-53r5 Moderate
Big Sur - Ensure System Integrity Protection is EnabledUnixNIST macOS Big Sur v1.4.0 - 800-53r5 Low
Big Sur - Ensure System Integrity Protection is EnabledUnixNIST macOS Big Sur v1.4.0 - All Profiles