Home
Mapping Frameworks
CSA CCM Home
Audit Logs Protection

CSA CCM LOG-02

Define, implement and evaluate processes, procedures and technical measures to ensure the security and retention of audit logs.

Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name	Notes
LOG-02	Audit Logs Protection	mitigates	T1070.009	Clear Persistence	Comments This control requires both CSP and CSC to independently protect and retain audit logs by implementing controls such as, centralized logging, secure and tamper-evident storage, access restrictions, regular monitoring and review ensuring logs remain available and trustworthy for investigations and protected against any improper modification and tampering.
LOG-02	Audit Logs Protection	mitigates	T1070.007	Clear Network Connection History and Configurations	Comments This control requires both CSP and CSC to independently protect and retain audit logs by implementing controls such as, centralized logging, secure and tamper-evident storage, access restrictions, regular monitoring and review ensuring logs remain available and trustworthy for investigations and protected against any improper modification and tampering.
LOG-02	Audit Logs Protection	mitigates	T1562.007	Disable or Modify Cloud Firewall	Comments This control requires both CSP and CSC to independently protect and retain audit logs by implementing controls such as, centralized logging, secure and tamper-evident storage, access restrictions, regular monitoring and review ensuring logs remain available and trustworthy for investigations and protected against any improper modification and tampering.
LOG-02	Audit Logs Protection	mitigates	T1562.008	Disable or Modify Cloud Logs	Comments This control requires both CSP and CSC to independently protect and retain audit logs by implementing controls such as, centralized logging, secure and tamper-evident storage, access restrictions, regular monitoring and review ensuring logs remain available and trustworthy for investigations and protected against any improper modification and tampering.
LOG-02	Audit Logs Protection	mitigates	T1562.001	Disable or Modify Tools	Comments This control requires both CSP and CSC to independently protect and retain audit logs by implementing controls such as, centralized logging, secure and tamper-evident storage, access restrictions, regular monitoring and review ensuring logs remain available and trustworthy for investigations and protected against any improper modification and tampering.
LOG-02	Audit Logs Protection	mitigates	T1562.012	Disable or Modify Linux Audit System	Comments This control requires both CSP and CSC to independently protect and retain audit logs by implementing controls such as, centralized logging, secure and tamper-evident storage, access restrictions, regular monitoring and review ensuring logs remain available and trustworthy for investigations and protected against any improper modification and tampering.
LOG-02	Audit Logs Protection	mitigates	T1070.001	Clear Windows Event Logs	Comments This control requires both CSP and CSC to independently protect and retain audit logs by implementing controls such as, centralized logging, secure and tamper-evident storage, access restrictions, regular monitoring and review ensuring logs remain available and trustworthy for investigations and protected against any improper modification and tampering.
LOG-02	Audit Logs Protection	mitigates	T1070.002	Clear Linux or Mac System Logs	Comments This control requires both CSP and CSC to independently protect and retain audit logs by implementing controls such as, centralized logging, secure and tamper-evident storage, access restrictions, regular monitoring and review ensuring logs remain available and trustworthy for investigations and protected against any improper modification and tampering.
LOG-02	Audit Logs Protection	mitigates	T1562.002	Disable Windows Event Logging	Comments This control requires both CSP and CSC to independently protect and retain audit logs by implementing controls such as, centralized logging, secure and tamper-evident storage, access restrictions, regular monitoring and review ensuring logs remain available and trustworthy for investigations and protected against any improper modification and tampering.
LOG-02	Audit Logs Protection	mitigates	T1562	Impair Defenses	Comments This control requires both CSP and CSC to independently protect and retain audit logs by implementing controls such as, centralized logging, secure and tamper-evident storage, access restrictions, regular monitoring and review ensuring logs remain available and trustworthy for investigations and protected against any improper modification and tampering.
LOG-02	Audit Logs Protection	mitigates	T1070	Indicator Removal	Comments This control requires both CSP and CSC to independently protect and retain audit logs by implementing controls such as, centralized logging, secure and tamper-evident storage, access restrictions, regular monitoring and review ensuring logs remain available and trustworthy for investigations and protected against any improper modification and tampering.