| Operating system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control, includes timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.
Rationale for non-applicability: This vulnerability is better addressed by CCI-000132, which is functionally indistinguishable from CCI-000133. |
