THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · AU-3

Content of Audit Records

US National Institute of Standards and Technology (NIST) · cited in 6 of our lessons

Explanation

What it asks for. Audit records must contain enough information to establish what type of event occurred, when and where it occurred, its source, its outcome and the identity of any individuals, subjects or objects involved.

In practice. This means checking that log formats from key systems include timestamps with time zone, user and system identifiers, source addresses and success or failure fields, and normalising them in the logging platform. Synchronised time across systems is essential. Auditors look for sample records, parsing configurations and time synchronisation settings. Privacy rules should guide what personal data appears in logs.

Common gaps. Logs from custom applications often lack user identity or outcome. Inconsistent time zones and unsynchronised clocks make event correlation unreliable. Logs may also contain too much, such as passwords or personal data.

Open SP 800-53 at NIST
The official text
Ensure that audit records contain information that establishes the following: a. What type of event occurred; b. When the event occurred; c. Where the event occurred; d. Source of the event; e. Outcome of the event; and f. Identity of any individuals, subjects, or objects/entities associated with the event. Discussion: Audit record content that may be necessary to support the auditing function includes event descriptions (item a), time stamps (item b), source and destination addresses (item c), user or process identifiers (items d and f), success or fail indications (item e), and filenames involved (items a, c, e, and f) . Event outcomes include indicators of event success or failure and event-specific results, such as the system security and privacy posture after the event occurred. Organizations consider how audit records can reveal information about individuals that may give rise to privacy risks and how best to mitigate such risks. For example, there is the potential to reveal personally identifiable information in the audit trail, especially if the trail records inputs or is based on patterns or time of usage.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered.