SM-11—Enterprise Antivirus Logging

>Control Description

If applicable, Organization's managed enterprise antivirus deployments generate audit logs which are retained for 1 year with 90 days of data immediately available for analysis.

Theme

Technology

Type

Detective

Policy/Standard

Logging & Monitoring Standard

>Implementation Guidance

1. Enable configurations for Enterprise Antivirus solutions to ensure that antivirus logs are being forwarded to the SIEM 2. Ensure that relevant logs are stored for a minimum period of 1 year with 90 days of logs being available for immediate analysis.

>Testing Procedure

1. Inspect configurations for Enterprise Antivirus solutions to validate that antivirus logs are being forwarded to SIEM. 2. Inspect sample antivirus logs for in-scope services to validate that relevant logs are stored for a minimum period of 1 year with 90 days of logs being available for immediate analysis.