Title

Audit data must be reviewed on a regular basis. (Cat II impact)

Discussion

To be of value, audit logs from critical systems must be reviewed on a regular basis. Critical systems should be reviewed on a daily basis to identify security breaches and potential weaknesses in the security structure. This can be done with the use of monitoring software or other utilities for this purpose.

Check Content

Determine whether audit logs are reviewed on a predetermined schedule. If audit logs are not reviewed on a regular basis, this is a finding.

Fix Text

Review audit logs on a predetermined scheduled.

Additional Identifiers

Rule ID: SV-226121r794316_rule

Vulnerability ID: V-226121

Group Title: SRG-OS-000255-GPOS-00096

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.