03.03.04E Integrated Analysis of Audit Records

Statement

Integrate analysis of audit records with analysis of {{ insert: param, A.03.03.04E.ODP.01 }} to further enhance the ability to identify inappropriate or unusual activity.

Guidance

Integrated analysis of audit records requires that the analysis of information generated by scanning, monitoring, or other data collection activities is integrated with the analysis of audit record information. Security information and event management (SIEM) tools can facilitate audit record aggregation or consolidation from multiple system components as well as audit record correlation and analysis. The use of standardized audit record analysis scripts developed by organizations (with localized script adjustments, as necessary) provides more cost-effective approaches to analyzing audit record information. The correlation of audit record information with vulnerability scanning information is important in determining the veracity of vulnerability scans of the system and in correlating attack detection events with scanning results. Correlation with performance data can uncover denial-of-service (DoS) attacks or other types of attacks that result in the unauthorized use of resources. Correlation with system monitoring information can also assist in uncovering attacks and relating audit information to operational situations. This requirement enhances SP 800-171 requirement 03.03.05.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

analysis of audit records is integrated with analysis of {{ insert: param, A.03.03.04E.ODP.01 }} to further enhance the ability to identify inappropriate or unusual activity.

Assessment method

• Audit and accountability policy system security plan procedures addressing audit review, analysis, and reporting system design documentation system configuration settings and associated documentation integrated analysis of audit records, vulnerability scanning information, performance data, network monitoring information and associated documentation other relevant documents or records

Assessment method

• Personnel with audit review, analysis, and reporting responsibilities personnel with information security responsibilities

Assessment method

• Mechanisms implementing the capability to integrate analysis of audit records with analysis of data or information sources

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

3. Zugehörige Regulierungen

Verknüpfte Vorgänge

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final