To support audit review, analysis, and reporting, SharePoint must integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.

From SharePoint 2010 Security Technical Implementation Guide (STIG)

Associated with IA controls: ECAT-2, ECAT-1

Associated with: CCI-000152

SV-36581r1_rule To support audit review, analysis, and reporting, SharePoint must integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.

Vulnerability discussion

Successful incident response and auditing relies on timely, accurate system information and analysis in order to allow the organization to identify and respond to potential incidents in a proficient manner. Audit review, analysis, and reporting are all activities are related to the evaluation of system activity through the inspection and analysis of system log data. Some examples include, but are not limited to, organizational requirements to cooperate with legal counsel and/or auditors in order to provide reports on certain types of system activity or analyzing system logs to ascertain sources or causes of certain system activity.

Check content

Since it is not reasonable to check every collection or library in a large implementation, sample test some of the site's site collections using the following procedures. SharePoint audits actions at the site level. 1. On the site collection home page, click Site Actions and then click Site Settings. 2. On the Site Settings page, in the Site Collection Administration list, click Site collection audit settings. 3. Mark as a finding if the organizationally defined settings are not checked in the "Documents and Items” and the “Lists, Libraries, and Sites” sections.

Fix text

1. On the site collection home page, click Site Actions, and then click Site Settings. 2. On the Site Settings page, in the Site Collection Administration list, click on Site collection audit settings. 3. In the Documents and Items section, specify the events to audit. 4. In the Lists, Libraries, and Sites section, specify the events to audit. 5. Click OK.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.