| name | AU-7(1)_automatic-processing |
| description | Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [organization-d |
| category | information-gathering |
| version | 5.2.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-53","rev5","au-7-1","au","enhancement"] |
| tech_stack | ["aws","azure","gcp","linux","windows"] |
| cwe_ids | ["CWE-778"] |
| chains_with | [] |
| prerequisites | ["AU-7"] |
| severity_boost | {} |
AU-7(1) Automatic Processing
Enhancement of: AU-7
High-Level Description
Family: Audit and Accountability (AU)
Framework: NIST SP 800-53 Rev 5
Events of interest can be identified by the content of audit records, including system resources involved, information objects accessed, identities of individuals, event types, event locations, event dates and times, Internet Protocol addresses involved, or event success or failure. Organizations may define event criteria to any degree of granularity required, such as locations selectable by a general networking location or by specific system component.
What to Check
How to Test
Step 1: Review Documentation
Examine the System Security Plan (SSP) and related artifacts for AU-7(1) implementation details. Verify the organization has documented how this control is satisfied.
Step 2: Validate Implementation
# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly
# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null
Step 3: Test Operating Effectiveness
Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.
Tools
| Tool | Purpose | Usage |
|---|
| cloud-audit-mcp | Check logging configuration | cloud_audit_logging |
| AWS CLI | Review CloudTrail/CloudWatch | aws cloudtrail describe-trails |
Remediation Guide
Control Statement
Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [organization-defined].
Implementation Guidance
Events of interest can be identified by the content of audit records, including system resources involved, information objects accessed, identities of individuals, event types, event locations, event dates and times, Internet Protocol addresses involved, or event success or failure. Organizations may define event criteria to any degree of granularity required, such as locations selectable by a general networking location or by specific system component.
