Collect URL Request Audit Logs
Description
Collect URL request audit logs on enterprise assets, where appropriate and supported.
Implementation Checklist
Tool Recommendations
SIEM platform with log management, threat detection, investigation, and compliance reporting across enterprise data sources
Cisco (Splunk) · Ingest-based or workload-based
Cloud-native SIEM and SOAR with AI-driven analytics, automated threat response, and native Azure/M365 integration
Microsoft · Pay-as-you-go (per GB ingested)
AI-driven SIEM with behavioral analytics, automated investigation, and SOAR capabilities for threat detection
Exabeam · Per-user subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Malicious URL Access Without Detection or Blocking
ConfidentialityUsers access phishing URLs, malware download sites, or attacker-controlled web applications, but without URL request logging the security team cannot identify compromised users or detect ongoing web-based attacks.
Drive-By Download Attacks Without Forensic Trail
IntegrityEnterprise assets visit compromised legitimate websites that deliver exploit kits, but without URL request logs there is no record of which assets visited the compromised site or when the infection occurred.
Vulnerabilities (When Safeguard Absent)
No Web Proxy or URL Request Logging
The organization does not log HTTP/HTTPS URL requests from enterprise assets, providing no visibility into web browsing patterns, malicious URL access, or web-based attack delivery vectors.
HTTPS Traffic Inspection Gap in URL Logging
URL logging only captures HTTP requests while HTTPS traffic passes uninspected, meaning the majority of modern web traffic including malicious communications is not recorded in audit logs.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Detection tool deployment evidence (dashboard screenshots, agent status) | Captured monthly |
| Technical | Sample alert/detection output demonstrating capability | Captured quarterly |
| Technical | SIEM dashboard showing log sources and collection status | Captured monthly |
| Record | Log review records and findings | Per review cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |