The application must provide a report generation capability that does not alter original content or time ordering of audit records.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-69475	APSC-DV-001220	SV-84097r1_rule		Medium

Description
If the audit report generation capability alters the original content or time ordering of audit records, the integrity of the audit records is compromised, and the records are no longer usable for forensic analysis. Time ordering refers to the chronological organization of records based on time stamps. The degree of time stamp precision can affect this. The report generation capability provided by the application can generate customizable reports. This requirement is specific to applications with audit reduction capabilities; however, applications need to support on-demand audit review and analysis.

Description

If the audit report generation capability alters the original content or time ordering of audit records, the integrity of the audit records is compromised, and the records are no longer usable for forensic analysis. Time ordering refers to the chronological organization of records based on time stamps. The degree of time stamp precision can affect this. The report generation capability provided by the application can generate customizable reports. This requirement is specific to applications with audit reduction capabilities; however, applications need to support on-demand audit review and analysis.

STIG	Date
Application Security and Development Security Technical Implementation Guide	2017-01-09

Details

Check Text ( C-69893r1_chk )
Review the application documentation and interview the application administrator for details regarding audit reduction (log record event filtering). Access the application with user rights sufficient to read and filter audit records. Navigate the application user interface and select the application functionality that provides access and interface to audit records and audit reduction (event filtering). If the application does not provide a report generation capability, the requirement is not applicable. Examine the log files; take note of dates and times of events such as logon events. Note: dates and times as well as the original content and any unique record identifiers. Record the identifying information as well as the dates and times and content of the audit records. Apply filters to reduce the amount of audit records displayed to just the logon events for the day. Review the records and ensure nothing in the records has changed. Once validated, clear the filter and review the records again to validate nothing changed within the audit record itself. If the application of event filters modifies the original log records, this is a finding.

Check Text ( C-69893r1_chk )

Review the application documentation and interview the application administrator for details regarding audit reduction (log record event filtering).

Access the application with user rights sufficient to read and filter audit records.

Navigate the application user interface and select the application functionality that provides access and interface to audit records and audit reduction (event filtering).

If the application does not provide a report generation capability, the requirement is not applicable.

Examine the log files; take note of dates and times of events such as logon events.

Note: dates and times as well as the original content and any unique record identifiers.

Record the identifying information as well as the dates and times and content of the audit records.

Apply filters to reduce the amount of audit records displayed to just the logon events for the day.

Review the records and ensure nothing in the records has changed. Once validated, clear the filter and review the records again to validate nothing changed within the audit record itself.

If the application of event filters modifies the original log records, this is a finding.

Fix Text (F-75651r1_fix)
Configure and design the application to not modify source logs when filtering events.