Content of Audit Records AU-3

Source: NIST SP 800-53 Rev.5, Audit and Accountability family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AU-3 (Content of Audit Records) says each log entry must carry enough detail to be useful: what type of event happened, when (timestamp), where it came from (source), the outcome (success or failure), and the identity of the user or process involved. It is the 'what is inside each record' companion to AU-2's 'what to log.'

What good looks like

• Every record answers what type of event happened and when (timestamp).
• Every record shows where it came from (source or host) and the outcome — success or failure.
• Every record ties to an identity — the user, account, or process, captured as the effective user ID (euid).
• The detail is enough to reconstruct the event later without guessing.

Framework mapping

• NIST CSF 2.0 — PR.PS-04 — Log records carry the detail needed for monitoring and investigation
• CIS Controls v8 — Control 8.2 / 8.5 — Collect detailed audit logs with the required fields

How to move it toward Implemented

• This is met on VM 607: auditd records already carry event type, timestamp, user and euid, the syscall, and the outcome — the fields AU-3 requires in each record.
• To reach 'Completed,' pull a sample record (ausearch -k priv or aureport) and attach it as asset-scoped evidence naming AU-3, so a reader can see a real record contains the required fields.
• No new configuration is needed — the same auditd and blue.rules stack that satisfies AU-2 produces AU-3-compliant record content.