SM-23—Security Monitoring Alert Criteria: Audit Log Integrity

>Control Description

Organization defines security monitoring alert criteria for changes to the integrity of audit logs.

Theme

Process

Type

Detective

Policy/Standard

Logging & Monitoring Standard

>Implementation Guidance

1. Ensure that Organization's Security Monitoring Standard includes requirements for security monitoring alert criteria for changes to the integrity of audit logs. 2. Ensure that the security monitoring rules are defined, enabled and alert applicable personnel on changes to the integrity of audit logs. 3. Ensure that alerts are being generated and sent to the SOC team to support remediation.

>Testing Procedure

1. Inspect Organization's Security Monitoring Standard to determine whether requirements for changes to the integrity of audit logs. 2. Inspect a sample of security monitoring rules, to validate that the rules are defined to look for and alert applicable personnel on changes to the integrity of audit logs. 3. Validate that alerts being generated are sent to the SOC team to support remediation.