Project History & Origin

This project originated in the mid-2000s, when Security Information and Event Management (SIEM) and log management tools were still developing. Handling cybersecurity incidents—especially within traditional government organizations—presented significant challenges due to the absence of standardized practices for auditing and logging.
Mid-2000s
Project initiated
Early 2007
Initial draft completed
2007-2008
Refined by colleagues
Dec 2008
Final document published

To address this gap in standardized practices, a unified set of guidelines for implementing effective auditing and logging in systems and applications was developed. The final document, Guidelines for Auditing and Logging, was published in December 2008 and serves as a foundational reference for organizations seeking to strengthen their logging and auditing practices.

Core Principles

📝 CompletenessLog all relevant security events across systems, applications, and infrastructure.
🛡️ Integrity ProtectionLogs protected from tampering, deletion, or unauthorized modification.
🔍 TimelinessReal-time or near-real-time log collection and alerting.
⚖️ AdmissibilityLogs meet evidentiary standards for legal proceedings.
📊 ActionabilityLogs structured and normalized for automated alerting and correlation.
🔐 ConfidentialitySensitive log data protected from unauthorized access.

Essential Log Types

🖥️ Operating System LogsSecurity logs, system logs, application logs, setup logs
🌐 Network Device LogsFirewall, router/switch, IDS/IPS, VPN, proxy, DNS logs
💾 Database LogsAccess logs, audit trails, transaction logs, schema changes
📧 Application LogsWeb server logs, email logs, API logs, custom audit trails
🔑 Authentication LogsLogins, privilege escalations, account lockouts, MFA events
☁️ Cloud & SaaS LogsCloudTrail, Azure Activity Logs, O365 audit logs, CASB logs

Auditing Framework

PhaseActivitiesDocumentation
1. Audit PlanningDefine scope, objectives, criteriaAudit charter, risk assessment
2. Evidence CollectionGather logs, verify integrityEvidence log, chain of custody
3. Analysis & TestingCorrelate events, identify gapsGap analysis, exception reports
4. ReportingDocument findings, recommendationsAudit report, remediation plan
5. Remediation & Follow-upTrack progress, verify fixesRemediation tracking, policy updates

Log Storage & Retention

🏷️ Retention Policy90 days active, 1-7 years archive based on legal requirements
🔒 Secure StorageEncryption at rest, access controls, immutable storage (WORM)
🗄️ Centralized CollectionSIEM, syslog server, cloud-native logging with NTP sync
📁 Backup & ArchivalRegular backups, off-site storage, integrity verification

Log Rotation & Management

  • Implement log rotation policies to prevent storage exhaustion
  • Compress archived logs to optimize storage
  • Maintain original log integrity during rotation
  • Document rotation schedule and retention periods
  • Test restoration from archived logs periodically

    • SIEM & Log Monitoring

    📊 Log NormalizationStandardize formats, timestamps, field names across sources
    ⚠️ Alerting & CorrelationRule-based alerts, behavioral analytics, threat intelligence
    📈 Dashboards & ReportingReal-time visualization, compliance dashboards
    🔄 Incident Response IntegrationAutomated ticket creation, case management
    # Example SIEM correlation rule # Multiple failed logins followed by successful login IF count(EventID 4625) > 5 FROM same_source_ip WITHIN 5 minutes AND THEN EventID 4624 FROM same_source_ip WITHIN 1 minute THEN ALERT "Possible brute force success" severity=HIGH

    Compliance & Regulatory Alignment

    📋 NIST SP 800-92Guide to Computer Security Log Management
    🔐 ISO/IEC 27001Sections A.12.4 (Logging) and A.12.4.3 (Admin logs)
    🏦 PCI DSSRequirement 10: Track and monitor access
    ⚕️ HIPAAAudit controls, access logs, security incident monitoring
    🌍 GDPRLogging of personal data access, breach notification
    🏢 SOXIT control logging, change management audit trails

    Implementation Checklist

    Log Generation:
  • All systems configured for logging
  • Critical events identified per source
  • Time synchronization via NTP
    • Log Collection:
  • Centralized collection point (SIEM/syslog)
  • Secure transmission (TLS)
  • Real-time forwarding capability
    • Log Storage:
  • Write-once, append-only storage
  • Access controls and segregation
  • Integrity hashing and verification
    • Monitoring:
  • Alert rules defined and tested
  • Incident response integration
  • Continuous improvement process

    • Repository Structure

    Guidelines-for-Auditing-and-Logging/
    ├── cisg-2008-01-1.pdf   # Original 2008 document
    ├── guidelines/   # Updated guidelines (markdown)
    ├── checklists/   # Implementation checklists
    ├── templates/   # Audit plan templates
    ├── examples/   # Sample log configurations
    └── README.md   # Project overview
    Explore the Repository

    📚 This is an overview of the complete Guidelines for Auditing and Logging.

    Access the Full Repository