[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fau-12":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","au-12","AU-12","Audit Record Generation",266,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Systems must be able to generate audit records for the event types defined under AU-2, let designated people choose which events are logged by which components, and produce the records with the content required by AU-3.\n\n**In practice.** This means enabling logging on operating systems, applications, databases, network devices and cloud services in line with the logging policy, and confirming those logs actually arrive centrally. Auditors expect configuration evidence, a mapping of log sources to required event types, and checks that sources have not gone silent. CIS Control 8 sets similar expectations.\n\n**Common gaps.** Logging is often enabled on servers but not on applications or SaaS platforms, or the default verbosity misses important events. Sources that stop sending logs are frequently not noticed.","a. Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [Assignment: organization-defined system components];\n  b. Allow [Assignment: organization-defined personnel or roles] to select the event types that are to be logged by specific components of the system; and\n  c. Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3).\nDiscussion: Audit records can be generated from many different system components. The event types specified in [AU-2d](#au-2_smt.d) are the event types for which audit logs are to be generated and are a subset of all event types for which the system can generate audit records.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"ai-model-misappropriates-third-party-crypto-funds-to-complete-task","AI Model Misappropriates Third-Party Crypto Funds to Complete Task","2026-10-16T16:20:58.749+00:00",{"slug":25,"title":26,"published_at":27},"ai-models-act-autonomously-to-bypass-auth-and-raid-crypto-wallets","AI Models Act Autonomously to Bypass Auth and Raid Crypto Wallets","2026-10-16T12:21:09.736+00:00",{"slug":29,"title":30,"published_at":31},"path-traversal-flaw-in-thermo-fisher-torrent-suite-exposes-sensitive-files","Path Traversal Flaw in Thermo Fisher Torrent Suite Exposes Sensitive Files","2026-10-15T18:21:22.798+00:00",{"slug":33,"title":34,"published_at":35},"cikabika-rat-abuses-discord-and-ngrok-to-evade-detection","CikaBika RAT Abuses Discord and Ngrok to Evade Detection","2026-10-15T12:20:40.147+00:00",{"slug":37,"title":38,"published_at":39},"langflow-rce-flaw-actively-exploited-via-unvalidated-command-injection","Langflow RCE Flaw Actively Exploited via Unvalidated Command Injection","2026-10-15T10:21:22.699+00:00",{"slug":41,"title":42,"published_at":43},"zero-click-sneakpeek-flaw-silently-exfiltrates-developer-credentials-from-claude-code","Zero-Click 'SneakPeek' Flaw Silently Exfiltrates Developer Credentials from Claude Code","2026-10-14T22:21:07.285+00:00",{"slug":45,"title":46,"published_at":47},"critical-litellm-flaws-allow-admin-takeover-and-api-key-theft","Critical LiteLLM Flaws Allow Admin Takeover and API Key Theft","2026-10-14T12:21:48.189+00:00",{"slug":49,"title":50,"published_at":51},"critical-litellm-flaws-allow-privilege-escalation-and-api-key-theft","Critical LiteLLM Flaws Allow Privilege Escalation and API Key Theft","2026-10-13T18:21:57.75+00:00",{"slug":53,"title":54,"published_at":55},"ai-coding-agents-require-dedicated-endpoint-visibility-and-forensic-controls","AI Coding Agents Require Dedicated Endpoint Visibility and Forensic Controls","2026-10-12T12:21:09.449+00:00",{"slug":57,"title":58,"published_at":59},"ai-augmented-cyberxero-campaign-exfiltrates-628000-ukrainian-records","AI-Augmented CyberXero Campaign Exfiltrates 628,000+ Ukrainian Records","2026-10-12T08:20:22.332+00:00",{"slug":61,"title":62,"published_at":63},"insider-threat-engineer-abuses-privileged-access-for-extortion","Insider Threat: Engineer Abuses Privileged Access for Extortion","2026-10-10T12:20:32.176+00:00",{"slug":65,"title":66,"published_at":67},"ahsaycbs-vulnerabilities-exploited-to-deploy-disguised-crypto-miners","AhsayCBS Vulnerabilities Exploited to Deploy Disguised Crypto Miners","2026-10-09T16:21:54.955+00:00",[69,74,79,84,88,93],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",161,{"slug":75,"name":76,"problem":77,"stories":78},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",71,{"slug":80,"name":81,"problem":82,"stories":83},"patch-management","Automated patch management","Known holes get closed in days, not months.",64,{"slug":85,"name":86,"problem":87,"stories":83},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":89,"name":90,"problem":91,"stories":92},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",43,{"slug":94,"name":95,"problem":96,"stories":97},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",39,[99,104,110,116,121,126,131,136],{"family":5,"item":100,"code":101,"title":102,"together":103},"ac-6","AC-6","Least Privilege",137,{"family":105,"item":106,"code":107,"title":108,"together":109},"gdpr","32","Article 32","Security of processing",117,{"family":111,"item":112,"code":113,"title":114,"together":115},"cis","7","Control 7","Continuous Vulnerability Management",105,{"family":117,"item":118,"code":119,"title":119,"together":120},"itil","overview","ITIL",91,{"family":5,"item":122,"code":123,"title":124,"together":125},"si-3","SI-3","Malicious Code Protection",90,{"family":5,"item":127,"code":128,"title":129,"together":130},"si-2","SI-2","Flaw Remediation",86,{"family":111,"item":132,"code":133,"title":134,"together":135},"2","Control 2","Inventory and Control of Software Assets",84,{"family":111,"item":137,"code":138,"title":139,"together":140},"13","Control 13","Network Monitoring and Defense",81]