AU.L2-3.3.6  

Reference: CMMC 2.11

Family: AU

Level Introduced: 2

Title: Reduction & Reporting

Practice:
Provide audit record reduction and report generation to support on-demand analysis and reporting.

CMMC Clarification:
Raw audit log data is difficult to review, analyze, and report because of the volume of data. Audit record reduction is an automated process that interprets raw audit log data and extracts meaningful and relevant information without altering the original logs. An example of log reduction for files to be analyzed would be the removal of details associated with nightly backups. Report generation on reduced log information allows you to create succinct customized reports without the need to burden the reader with unimportant information. In addition, the security relevant audit information must be made available to personnel on- demand for immediate review, analysis, reporting, and event investigation support. Peforming audit log reduction and providing on-demand reports may allow the analyst to take mitigating action before the adversary completes their malicious actions.

Example
You are in charge of IT operations in your organization. You are responsible for providing audit record reduction and report generation capability to effectively extract security relevant information. You either purchase or develop a capability that will collect and analyze data for signs of anomalies. The system then extracts security relevant data to provide a reduced, concise, and comprehensive view for further analysis to identify potentially malicious activity on your network. In addition to creating on-demand data sets for analysis, you create customized reports explaining the contents of the data set.

Source: CMMC v2.0