To support audit review, analysis, and reporting, SharePoint must integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-28184	SHPT-00-000405	SV-36581r1_rule	ECAT-1 ECAT-2	Low

Description
Successful incident response and auditing relies on timely, accurate system information and analysis in order to allow the organization to identify and respond to potential incidents in a proficient manner. Audit review, analysis, and reporting are all activities are related to the evaluation of system activity through the inspection and analysis of system log data. Some examples include, but are not limited to, organizational requirements to cooperate with legal counsel and/or auditors in order to provide reports on certain types of system activity or analyzing system logs to ascertain sources or causes of certain system activity.

Description

Successful incident response and auditing relies on timely, accurate system information and analysis in order to allow the organization to identify and respond to potential incidents in a proficient manner. Audit review, analysis, and reporting are all activities are related to the evaluation of system activity through the inspection and analysis of system log data. Some examples include, but are not limited to, organizational requirements to cooperate with legal counsel and/or auditors in order to provide reports on certain types of system activity or analyzing system logs to ascertain sources or causes of certain system activity.

STIG	Date
SharePoint 2010 Security Technical Implementation Guide (STIG)	2011-12-20

Details

Check Text ( C-37273r1_chk )
SharePoint audits actions at the site level. 1. Log on to SharePoint Central Administration. 2. Click on “Site Actions” and select “Site Settings”. 3. Click on “Site collection audit settings”. 4. Ensure the organizationally-defined settings are checked in the “Documents and Items” and “Lists, Libraries, and Sites” boxes. If not, this is a finding.

Fix Text (F-32510r1_fix)
1. Log on to SharePoint Central Administration. 2. Click on “Site Actions” and select “Site Settings”. 3. Click on “Site collection audit settings”. 4. In the “Documents and Items” box, specify the events to audit. 5. In the “Lists, Libraries, and Sites” box, specify the events to audit. 6. Click on “OK”.