View source for SPA Objectives - SIEM Tool

== When is a SIEM an SPA? ==
A SIEM is an SPA when it ingests/aggregates logs from one or more CUI assets.

== Assessment Objectives to Assess ==
AU.L2-3.3.1 - SYSTEM AUDITING [c,d,f]

* A SIEM will shows audit records are created, contain the defined content, and are retained as defined.

AU.L2-3.3.2 - USER ACCOUNTABILITY [b]

* The SIEM will show that audit records contain the defined content necessary to trace users to their actions.

AU.L2-3.3.4 - AUDIT FAILURE ALERTING [c]

* A SIEM may be able to show that identified personnel/roles are alerted in an audit logging process failure.

AU.L2-3.3.5 - AUDIT CORRELATION [b]

* A SIEM can help show review, analysis, and reporting processes are correlated.

AU.L2-3.3.6 - REDUCTION & REPORTING [a,b]

* A SIEM can be used to show on-demand analysis and reporting of audit logs

AU.L2-3.3.8 - AUDIT PROTECTION [a-f]

* The SIEM will show how audit information and tools are protected from unauthorized access, modification, and deletion.

AU.L2-3.3.9 - AUDIT MANAGEMENT [b]

* The SIEM would need to be shown to demonstrate that a subset of users have access to manage the SIEM.

IR.L2-3.6.1 - INCIDENT HANDLING [c,d]

* A SIEM will likely help support detection and analysis during an incident.

SI.L2-3.14.6 - MONITOR COMMUNICATIONS FOR ATTACKS [a,b,c]

* A SIEM can show that the system, inbound traffic, and outbound traffic are monitored to detect attacks.

SI.L2-3.14.7 - IDENTIFY UNAUTHORIZED USE [b]

* A SIEM will likely show that unauthorized use is identified.



== Assessment Objectives that won't likely be Assessed ==
AU.L2-3.3.3 - EVENT REVIEW

* A SIEM will likely not contain evidence that event types to be logged are reviewed and updated.

AU.L2-3.3.7 - AUTHORITATIVE TIME SOURCE

* No AOs require a SIEM to demonstrate that an authoritative time source is selected and used.