Navigate

Check: APSC-DV-000700

Application Security and Development STIG: APSC-DV-000700 (in versions v5 r3 through v4 r2)

Title

The application must record the username or user ID of the user associated with the event. (Cat II impact)

Discussion

When users conduct activity within an application, that user’s identity must be recorded in the audit log. Failing to record the identity of the user responsible for the activity within the application is detrimental to forensic analysis.

Check Content

Review and monitor the application logs. Connect to the application and perform application activity that is allowed by the user such as accessing data or running reports. Observe if the log includes an entry to indicate the user ID of the user that conducted the activity. If the user ID is not recorded along with the event in the event log, this is a finding.

Fix Text

Configure the application to record the user ID of the user responsible for the log event entry.

Additional Identifiers

Rule ID: SV-222449r879559_rule

Vulnerability ID: V-222449

Group Title: SRG-APP-000089

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-000169	The information system provides audit record generation capability for the auditable events defined in AU-2 a. at organization-defined information system components.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
AU-12	Audit Generation