Ensure Adequate Audit Log Storage
Description
Ensure that logging destinations maintain adequate storage to comply with the enterprise’s audit log management process.
Implementation Checklist
Tool Recommendations
SIEM platform with log management, threat detection, investigation, and compliance reporting across enterprise data sources
Cisco (Splunk) · Ingest-based or workload-based
Cloud-native SIEM and SOAR with AI-driven analytics, automated threat response, and native Azure/M365 integration
Microsoft · Pay-as-you-go (per GB ingested)
High-performance log management and observability platform designed for petabyte-scale data with real-time search
CrowdStrike · Per-GB subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Log Data Loss from Storage Exhaustion
IntegrityCritical audit log data is silently overwritten or discarded when logging destinations run out of storage, destroying evidence of ongoing attacks or compliance-required records during the exact periods when they are most needed.
Denial of Logging via Storage Flooding Attack
AvailabilityAttackers intentionally generate massive volumes of log entries to exhaust available storage, causing legitimate audit events to be dropped and creating a window of unmonitored activity for their actual malicious operations.
Vulnerabilities (When Safeguard Absent)
No Storage Capacity Monitoring for Log Destinations
Log storage volumes are not monitored for capacity, and no alerts fire when storage approaches capacity thresholds, resulting in silent log loss when disks fill up during high-activity periods or attacks.
Undersized Log Storage Without Retention Alignment
Log storage capacity is insufficient to retain logs for the period defined by the organization's retention policy, forcing either premature log deletion or logging failures that compromise both compliance and forensic capability.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Technical | SIEM dashboard showing log sources and collection status | Captured monthly |
| Record | Log review records and findings | Per review cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |