AU-6(3)—Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories

IL4 Mod

IL4 High

IL5

IL6

>Control Description

Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.

>DoD Impact Level Requirements

No specific parameter values or requirements for this impact level.

>Discussion

Organization-wide situational awareness includes awareness across all three levels of risk management (i.e., organizational level, mission/business process level, and information system level) and supports cross-organization awareness.

>Programmatic Queries

Beta

Related Services

CloudTrail

CloudWatch

Athena

CLI Commands

Configure CloudTrail to aggregate logs from multiple accounts

aws cloudtrail create-trail --name multi-account-trail --s3-bucket-name central-audit-bucket --is-multi-region-trail --region us-east-1

Create CloudWatch Logs group to centralize audit data from multiple repositories

aws logs create-log-group --log-group-name /aws/centralized-audit-repository

Use Athena to correlate and query across multiple audit repositories

aws athena start-query-execution --query-string 'SELECT * FROM cloudtrail_logs WHERE eventTime > date_format(current_timestamp - interval \'24\' hour, \'%Y-%m-%dT%H:%i:%sZ\')' --query-execution-context Database=default --result-configuration OutputLocation=s3://audit-results/

Setup EventBridge cross-account event correlation

aws events put-event-bus-policy --name default --policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::ACCOUNT-ID:root"},"Action":"events:PutEvents","Resource":"arn:aws:events:region:ACCOUNT-ID:event-bus/default"}]}'

Open AWS Console Documentation

>Related Controls

AU-12

IR-4

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

•What formal policies and procedures govern the implementation of AU-6(3) (Correlate Audit Record Repositories)?
•Who are the designated roles responsible for implementing, maintaining, and monitoring AU-6(3)?
•How frequently is the AU-6(3) policy reviewed and updated, and what triggers policy changes?
•What training or awareness programs ensure personnel understand their responsibilities related to AU-6(3)?

Technical Implementation:

•Describe the specific technical mechanisms or controls used to enforce AU-6(3) requirements.
•What automated tools, systems, or technologies are deployed to implement AU-6(3)?
•How is AU-6(3) integrated into your system architecture and overall security posture?
•What configuration settings, parameters, or technical specifications enforce AU-6(3) requirements?

Evidence & Documentation:

•What documentation demonstrates the complete implementation of AU-6(3)?
•What audit logs, records, reports, or monitoring data validate AU-6(3) compliance?
•Can you provide evidence of periodic reviews, assessments, or testing of AU-6(3) effectiveness?
•What artifacts would you present during a FedRAMP assessment to demonstrate AU-6(3) compliance?

Ask AI

Configure your API key to use AI features.