AU-6(4)

AU-6(4): Central Review and Analysis

Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.

Automated mechanisms for centralized reviews and analyses include Security Information and Event Management products.

Overlays
Classified, DAF Baseline, Int-A, Int-B, Int-C

CSF Categories
None

The controls below (if any) were marked by NIST as being related to AU-6(4).

Control	Description
AU-2	a: Identify the types of events that the system is capable of logging in support of the audit function: [the event types that the system is capable of logging in support of the audit function are defined;]; b: Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged; c: Specify the following event types for logging within the system: [one of ]; d: Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and e: Review and update the event types selected for logging [the frequency of event types selected for logging are reviewed and updated;].
AU-12	a: Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [system components that provide an audit record generation capability for the events types (defined in AU-02_ODP[02]) are defined;]; b: Allow [personnel or roles allowed to select the event types that are to be logged by specific components of the system is/are defined;] to select the event types that are to be logged by specific components of the system; and c: Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3).

Control

Description

a: Identify the types of events that the system is capable of logging in support of the audit function: [the event types that the system is capable of logging in support of the audit function are defined;];

b: Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;

d: Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and

e: Review and update the event types selected for logging [the frequency of event types selected for logging are reviewed and updated;].

a: Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [system components that provide an audit record generation capability for the events types (defined in AU-02_ODP[02]) are defined;];

b: Allow [personnel or roles allowed to select the event types that are to be logged by specific components of the system is/are defined;] to select the event types that are to be logged by specific components of the system; and

c: Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3).

The controls below (if any) add on to the requirements of AU-6(4).

Control	Description
No controls

The CCIs below are tied to AU-6(4).

CCI	Definition
CCI-000154	Provide the capability to centrally review and analyze audit records from multiple components within the system.
CCI-003821	Implement the capability to centrally review and analyze audit records from multiple components within the system.