Conduct Audit Log Reviews
Description
Conduct reviews of audit logs to detect anomalies or abnormal events that could indicate a potential threat. Conduct reviews on a weekly, or more frequent, basis.
Implementation Checklist
Tool Recommendations
SIEM platform with log management, threat detection, investigation, and compliance reporting across enterprise data sources
Cisco (Splunk) · Ingest-based or workload-based
Cloud-native SIEM and SOAR with AI-driven analytics, automated threat response, and native Azure/M365 integration
Microsoft · Pay-as-you-go (per GB ingested)
High-performance log management and observability platform designed for petabyte-scale data with real-time search
CrowdStrike · Per-GB subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Prolonged Attacker Dwell Time from Unreviewed Logs
ConfidentialityAudit logs capture indicators of compromise including failed authentication attempts, privilege escalation events, and unusual data access patterns, but without regular review these warnings go unnoticed while attackers operate freely for months.
Missed Insider Threat Indicators in Stale Log Data
ConfidentialityAudit logs contain patterns indicating insider threats such as after-hours data access, bulk downloads, or privilege abuse, but without weekly log reviews these behavioral anomalies are never flagged or investigated.
Brute Force Attacks Succeeding Without Alert Escalation
ConfidentialityBrute force and password spraying attacks generate obvious log patterns across authentication systems, but without scheduled log reviews and anomaly detection these attacks succeed before anyone notices the authentication anomalies.
Vulnerabilities (When Safeguard Absent)
No Scheduled Log Review Process or Cadence
The organization collects audit logs but has no process for regularly reviewing them, treating log collection as a compliance checkbox rather than an active threat detection capability.
No Defined Anomaly Detection Criteria for Log Reviews
Even when logs are reviewed, analysts lack defined criteria for what constitutes an anomaly or abnormal event, resulting in subjective and inconsistent review quality that misses subtle indicators of compromise.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Detection tool deployment evidence (dashboard screenshots, agent status) | Captured monthly |
| Technical | Sample alert/detection output demonstrating capability | Captured quarterly |
| Technical | SIEM dashboard showing log sources and collection status | Captured monthly |
| Record | Log review records and findings | Per review cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |