last sync: 2023-Jun-02 17:44:47 UTC

Azure Policy definition

Ensure audit records are not altered

Name Ensure audit records are not altered
Azure Portal
Id 27ce30dd-3d56-8b54-6144-e26d9a37a541
Version 1.1.0
details on versioning
Category Regulatory Compliance
Microsoft docs
Description CMA_C1125 - Ensure audit records are not altered
Mode All
Type BuiltIn
Preview FALSE
Deprecated FALSE
Effect Default
Manual
Allowed
Manual, Disabled
RBAC
Role(s)
none
Rule
Aliases
Rule
ResourceTypes
IF (1)
Microsoft.Resources/subscriptions
Compliance The following 7 compliance controls are associated with this Policy definition 'Ensure audit records are not altered' (27ce30dd-3d56-8b54-6144-e26d9a37a541)
Control Domain Control Name MetadataId Category Title Owner Requirements Description Info Policy#
FedRAMP_High_R4 AU-7 FedRAMP_High_R4_AU-7 FedRAMP High AU-7 Audit And Accountability Audit Reduction And Report Generation Shared n/a The information system provides an audit reduction and report generation capability that: a. Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and b. Does not alter the original content or time ordering of audit records. Supplemental Guidance: Audit reduction is a process that manipulates collected audit information and organizes such information in a summary format that is more meaningful to analysts. Audit reduction and report generation capabilities do not always emanate from the same information system or from the same organizational entities conducting auditing activities. Audit reduction capability can include, for example, modern data mining techniques with advanced data filters to identify anomalous behavior in audit records. The report generation capability provided by the information system can generate customizable reports. Time ordering of audit records can be a significant issue if the granularity of the timestamp in the record is insufficient. Related control: AU-6. References: None. link 2
FedRAMP_Moderate_R4 AU-7 FedRAMP_Moderate_R4_AU-7 FedRAMP Moderate AU-7 Audit And Accountability Audit Reduction And Report Generation Shared n/a The information system provides an audit reduction and report generation capability that: a. Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and b. Does not alter the original content or time ordering of audit records. Supplemental Guidance: Audit reduction is a process that manipulates collected audit information and organizes such information in a summary format that is more meaningful to analysts. Audit reduction and report generation capabilities do not always emanate from the same information system or from the same organizational entities conducting auditing activities. Audit reduction capability can include, for example, modern data mining techniques with advanced data filters to identify anomalous behavior in audit records. The report generation capability provided by the information system can generate customizable reports. Time ordering of audit records can be a significant issue if the granularity of the timestamp in the record is insufficient. Related control: AU-6. References: None. link 2
hipaa 1205.09aa2System.1-09.aa hipaa-1205.09aa2System.1-09.aa 1205.09aa2System.1-09.aa 12 Audit Logging & Monitoring 1205.09aa2System.1-09.aa 09.10 Monitoring Shared n/a Logs of messages sent and received are maintained including the date, time, origin and destination of the message, but not its contents. 6
hipaa 1215.09ab2System.7-09.ab hipaa-1215.09ab2System.7-09.ab 1215.09ab2System.7-09.ab 12 Audit Logging & Monitoring 1215.09ab2System.7-09.ab 09.10 Monitoring Shared n/a Auditing and monitoring systems employed by the organization support audit reduction and report generation. 4
hipaa 1219.09ab3System.10-09.ab hipaa-1219.09ab3System.10-09.ab 1219.09ab3System.10-09.ab 12 Audit Logging & Monitoring 1219.09ab3System.10-09.ab 09.10 Monitoring Shared n/a The information system is able to automatically process audit records for events of interest based on selectable criteria. 4
NIST_SP_800-53_R4 AU-7 NIST_SP_800-53_R4_AU-7 NIST SP 800-53 Rev. 4 AU-7 Audit And Accountability Audit Reduction And Report Generation Shared n/a The information system provides an audit reduction and report generation capability that: a. Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and b. Does not alter the original content or time ordering of audit records. Supplemental Guidance: Audit reduction is a process that manipulates collected audit information and organizes such information in a summary format that is more meaningful to analysts. Audit reduction and report generation capabilities do not always emanate from the same information system or from the same organizational entities conducting auditing activities. Audit reduction capability can include, for example, modern data mining techniques with advanced data filters to identify anomalous behavior in audit records. The report generation capability provided by the information system can generate customizable reports. Time ordering of audit records can be a significant issue if the granularity of the timestamp in the record is insufficient. Related control: AU-6. References: None. link 2
NIST_SP_800-53_R5 AU-7 NIST_SP_800-53_R5_AU-7 NIST SP 800-53 Rev. 5 AU-7 Audit and Accountability Audit Record Reduction and Report Generation Shared n/a Provide and implement an audit record reduction and report generation capability that: a. Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and b. Does not alter the original content or time ordering of audit records. link 2
History
Date/Time (UTC ymd) (i) Change type Change detail
2022-09-27 16:35:32 change Minor (1.0.0 > 1.1.0)
2022-09-19 17:41:40 add 27ce30dd-3d56-8b54-6144-e26d9a37a541
Initiatives
usage
Initiative DisplayName Initiative Id Initiative Category State Type
FedRAMP High d5264498-16f4-418a-b659-fa7ef418175f Regulatory Compliance GA BuiltIn
FedRAMP Moderate e95f5a9f-57ad-4d03-bb0b-b1d16db93693 Regulatory Compliance GA BuiltIn
HITRUST/HIPAA a169a624-5599-4385-a696-c8d643089fab Regulatory Compliance GA BuiltIn
NIST SP 800-53 Rev. 4 cf25b9c1-bd23-4eb6-bd2c-f4f3ac644a5f Regulatory Compliance GA BuiltIn
NIST SP 800-53 Rev. 5 179d1daa-458f-4e47-8086-2a68d0d6c38f Regulatory Compliance GA BuiltIn
JSON