ComplianceNIST 800-53 control

NIST-AU-7 Audit Record Reduction and Report Generation

Official page ↗

Framework: NIST SP 800-53 rev5 (5.2.0)
Family: AU Audit and Accountability
Control: AU-7

Control statement

Provide and implement an audit record reduction and report generation capability that: a. Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and b. Does not alter the original content or time ordering of audit records.

Discussion

Audit record reduction is a process that manipulates collected audit log information and organizes it into a summary format that is more meaningful to analysts. Audit record reduction and report generation capabilities do not always emanate from the same system or from the same organizational entities that conduct audit logging activities. The audit record reduction capability includes modern data mining techniques with advanced data filters to identify anomalous behavior in audit records. The report generation capability provided by the system can generate customizable reports. Time ordering of audit records can be an issue if the granularity of the timestamp in the record is insufficient.

Related control · Compliance (13)

NIST-AC-2 Account Management NIST 800-53 control
NIST-AU-12 Audit Record Generation NIST 800-53 control
NIST-AU-16 Cross-organizational Audit Logging NIST 800-53 control
NIST-AU-2 Event Logging NIST 800-53 control
NIST-AU-3 Content of Audit Records NIST 800-53 control
NIST-AU-4 Audit Log Storage Capacity NIST 800-53 control
NIST-AU-5 Response to Audit Logging Process Failures NIST 800-53 control
NIST-AU-6 Audit Record Review, Analysis, and Reporting NIST 800-53 control
NIST-CM-5 Access Restrictions for Change NIST 800-53 control
NIST-IA-5 Authenticator Management NIST 800-53 control
NIST-IR-4 Incident Handling NIST 800-53 control
NIST-PM-12 Insider Threat Program NIST 800-53 control
NIST-SI-4 System Monitoring NIST 800-53 control

Referenced by Compliance · enhancement of (1)

NIST-AU-7(1) Automatic Processing NIST 800-53 enhancement

Referenced by Compliance · has member (1)

NIST-AU Audit and Accountability NIST 800-53 family

Referenced by Compliance · related control (14)

NIST-AC-2(12) Account Monitoring for Atypical Usage NIST 800-53 enhancement
NIST-AU-12 Audit Record Generation NIST 800-53 control
NIST-AU-16 Cross-organizational Audit Logging NIST 800-53 control
NIST-AU-2 Event Logging NIST 800-53 control
NIST-AU-4 Audit Log Storage Capacity NIST 800-53 control
NIST-AU-5 Response to Audit Logging Process Failures NIST 800-53 control
NIST-AU-6 Audit Record Review, Analysis, and Reporting NIST 800-53 control
NIST-CM-3(7) Review System Changes NIST 800-53 enhancement
NIST-CM-5(1) Automated Access Enforcement and Audit Records NIST 800-53 enhancement
NIST-IA-5(9) Federated Credential Management NIST 800-53 enhancement
NIST-IR-4 Incident Handling NIST 800-53 control
NIST-IR-5 Incident Monitoring NIST 800-53 control
NIST-PM-12 Insider Threat Program NIST 800-53 control
NIST-SI-4 System Monitoring NIST 800-53 control