Are audit logs available that include AT LEAST all of the following: login, logout, actions performed, and source IP address?
Explanation
Audit logging is what's being probed: reviewers want assurance that your system records user activity in detail, including logins, logouts, actions taken, and source IP addresses. Specifically, it's asking if your logs capture at least four critical elements:
- Login events (when users successfully authenticate)
- Logout events (when users end their sessions)
- Actions performed (what users did while logged in)
- Source IP addresses (where users connected from)
Audit logs are essential for security because they create a record of who did what and when, which is crucial for:
- Detecting unauthorized access or suspicious behavior
- Investigating security incidents after they occur
- Demonstrating compliance with regulations
- Troubleshooting system issues
The question is being asked because without proper audit logging, organizations cannot effectively monitor their systems for security threats, investigate incidents, or prove compliance with security requirements. The asterisk (*) indicates this is likely a mandatory requirement in the assessment.
To best answer this question, you should:
- Confirm whether your system logs all four required elements
- Describe how these logs are captured, stored, and protected
- Mention any additional audit logging capabilities beyond the minimum requirements
- Note how long logs are retained and how they can be accessed for review
If your system doesn't capture all four elements, be honest about what's missing and any plans to address those gaps.
Example Responses
Example Response 1
Yes, our application maintains comprehensive audit logs that exceed the minimum requirements Our logging system captures user login events (including failed attempts), logout events (both manual and timeout-based), all user actions performed within the system (with details of the specific resources accessed and modifications made), and the source IP address for all connections These logs are stored in a tamper-evident format, encrypted at rest, and retained for 12 months in accordance with our data retention policy Logs can be exported in common formats (CSV, JSON) for analysis and are integrated with our SIEM solution for real-time security monitoring Access to audit logs is restricted to authorized security personnel and requires multi-factor authentication.
Example Response 2
Yes, our platform maintains detailed audit logs covering all required elements Each log entry includes timestamp, event type (login/logout/action), user ID, source IP address, and action details For actions performed, we log the specific function accessed, parameters used, and affected resources Our logging infrastructure uses a distributed architecture with redundant storage to prevent data loss, and logs are retained for 24 months to support compliance requirements We also capture additional contextual information such as user agent details, session identifiers, and the success/failure status of each action Logs are searchable through our admin console and can be filtered by any field to facilitate incident investigation.
Example Response 3
No, our current audit logging system captures login events, actions performed, and source IP addresses, but does not consistently log logout events This limitation exists because our application uses a token-based authentication system where sessions expire rather than requiring explicit logouts We recognize this gap in our logging capabilities and are implementing an enhancement in our next release (scheduled for Q3) that will track token expiration and explicit logout events In the interim, we can approximate logout times by analyzing the last recorded action for a session combined with our token expiration settings We understand this doesn't fully meet the requirement and are prioritizing this enhancement to achieve full compliance.
Context
- Tab
- Product
- Category
- Authentication, Authorization, and Account Management
Related questions
- Does your solution support single sign-on (SSO) protocols for user and administrator authentication?
- For customers not using SSO, does your solution support local authentication protocols for user and administrator authentication?
- For customers not using SSO, can you enforce password/passphrase complexity requirements (provided by the institution)?
- For customers not using SSO, does the system have password complexity or length limitations and/or restrictions?
- For customers not using SSO, do you have documented password/passphrase reset procedures that are currently implemented in the system and/or customer support?
- Does your organization participate in InCommon or another eduGAIN-affiliated trust federation?
