Collect Detailed Audit Logs
Description
Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation.
Implementation Checklist
Tool Recommendations
SIEM platform with log management, threat detection, investigation, and compliance reporting across enterprise data sources
Cisco (Splunk) · Ingest-based or workload-based
Cloud-native SIEM and SOAR with AI-driven analytics, automated threat response, and native Azure/M365 integration
Microsoft · Pay-as-you-go (per GB ingested)
High-performance log management and observability platform designed for petabyte-scale data with real-time search
CrowdStrike · Per-GB subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Insufficient Forensic Detail to Identify Attack Origin
ConfidentialityBasic audit logs capture only that an event occurred but lack source addresses, destination addresses, usernames, and other contextual details needed to determine who initiated the activity, from where, and what was affected.
Sensitive Data Breach with No Attribution Trail
ConfidentialityAn attacker accesses sensitive data stores, but the logs lack sufficient detail (user identity, source IP, accessed records) to identify the compromised account, determine the scope of data exposure, or satisfy breach notification requirements.
Vulnerabilities (When Safeguard Absent)
Default Logging Levels Without Detailed Event Fields
Assets containing sensitive data use default logging configurations that capture minimal event details, omitting critical fields like source/destination addresses, user identities, and object-level access details needed for forensic analysis.
No Logging Standards for Sensitive Data Assets
The organization has not defined which detailed fields must be captured in audit logs for assets processing sensitive data, resulting in inconsistent and insufficient logging detail across databases, file servers, and applications.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Detection tool deployment evidence (dashboard screenshots, agent status) | Captured monthly |
| Technical | Sample alert/detection output demonstrating capability | Captured quarterly |
| Technical | SIEM dashboard showing log sources and collection status | Captured monthly |
| Record | Log review records and findings | Per review cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |