Navigate

AU-7(2)

AU-7(2): Automatic Sort and Search

The information system provides the capability to sort and search audit records for events of interest based on the content of [organization-defined audit fields within audit records].

Supplemental

Sorting and searching of audit records may be based upon the contents of audit record fields, for example: (i) date/time of events; (ii) user identifiers; (iii) Internet Protocol (IP) addresses involved in the event; (iv) type of event; or (v) event success/failure.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to AU-7(2).

Control	Description
No controls

Enhancements

The controls below (if any) add on to the requirements of AU-7(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AU-7(2).

CCI	Definition
CCI-001884	The organization defines the audit fields within audit records to be sorted for events of interest by the information system.
CCI-001885	The organization defines the audit fields within audit records to be searched for events of interest by the information system.
CCI-001886	The information system provides the capability to sort audit records for events of interest based on the content of organization-defined audit fields within audit records.
CCI-001887	The information system provides the capability to search audit records for events of interest based on the content of organization-defined audit fields within audit records.