Collect Audit Logs
Description
Collect audit logs. Ensure that logging, per the enterprise’s audit log management process, has been enabled across enterprise assets.
Implementation Checklist
Tool Recommendations
SIEM platform with log management, threat detection, investigation, and compliance reporting across enterprise data sources
Cisco (Splunk) · Ingest-based or workload-based
Cloud-native SIEM and SOAR with AI-driven analytics, automated threat response, and native Azure/M365 integration
Microsoft · Pay-as-you-go (per GB ingested)
High-performance log management and observability platform designed for petabyte-scale data with real-time search
CrowdStrike · Per-GB subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Blind Spots Enabling Undetected Compromise
ConfidentialityAttackers specifically target assets where audit logging is disabled or not collected, knowing their activities will leave no forensic trail, enabling prolonged dwell times and undetected data exfiltration.
Tampering Without Evidence on Unlogged Systems
IntegrityMalicious insiders or external attackers modify critical data, configurations, or access controls on systems where audit logs are not collected, making it impossible to detect or attribute unauthorized changes.
Anti-Forensics Exploitation of Logging Gaps
ConfidentialitySophisticated attackers route their activities through assets without log collection, using these blind spots as staging areas for lateral movement and data staging while remaining invisible to security monitoring.
Vulnerabilities (When Safeguard Absent)
Audit Logging Disabled on Critical Enterprise Assets
Key servers, databases, network devices, and cloud services have audit logging disabled by default or intentionally turned off to conserve resources, creating forensic blind spots across the infrastructure.
Inconsistent Log Collection Across Asset Types
Logging is enabled on some asset categories (e.g., domain controllers) but not others (e.g., Linux servers, network appliances, SaaS applications), leaving significant portions of the environment without audit trails.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Detection tool deployment evidence (dashboard screenshots, agent status) | Captured monthly |
| Technical | Sample alert/detection output demonstrating capability | Captured quarterly |
| Technical | SIEM dashboard showing log sources and collection status | Captured monthly |
| Record | Log review records and findings | Per review cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |