Monika Sharma

Webgui Audit logs requires to capture more details mentioned in the business impact statement.

Customer has a requirement to have below points covered on the audit logs:

• Authentication: logins, logouts, failed attempts, lockouts, MFA events, password changes
• Authorization: access denied, privilege escalation, role or group changes
• Data changes: create, modify and delete of important records or config
• Sensitive data access: reads of confidential data, exports and download
• Admin actions: user creation, config changes, policy changes, service restart
• Security-relevant system events: audit log start, stop or clearing, and changes to log settings.

The vendor must generate comprehensive security and user activity logs sufficient to trace the event details. Each log entry must be unique and shall contain the following attributes at a minimum:

Timestamp: The date and time the event occurred, recorded in Coordinated Universal Time (UTC), in line with ISO8601/RFC3339. The timestamp must be at the beginning of each log entry.
Unique ID: A unique identifier for the specific event instance to enable correlation with other events.
Event ID/Type: A unique identifier or type to categorise the event (e.g., login\_denied).
Activity Description: A human-readable description of the activity performed.
Outcome/Reason: The result of the activity, such as success or failure, along with a reason for the outcome (e.g., access denied - invalid credentials).
Hostname/Domain: The hostname or domain name of the system where the event occurred.
User/Service Account: The identity of the user or service account associated with the activity.
Network Source: The source IP address, MAC address, and/or hostname from which the activity originated.
Network Destination: The destination IP address and/or hostname to which the activity was directed.
Protocol: The network protocol in the log event (e.g., TCP, UDP, HTTPS).
Port: The network port accessed.
Connection Method: The method used to establish the connection (e.g., API call, SSH, web request).
Referring URL/Page: If the event is a web request, the URL of the referring page.
File Details: The filename and file type if the event involves a file transfer.