Audit Record Reduction and Report Generation AU-7

Source: NIST SP 800-53 Rev.5, Audit and Accountability family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AU-7 (Audit Record Reduction and Report Generation) is about being able to turn a mountain of raw logs into something a person can search and report on — without changing the original records. ‘Reduction’ means filtering and summarizing; the raw logs stay untouched as the source of truth. It is an Audit and Accountability control in the Moderate baseline.

What good looks like

• Be able to search and filter logs on demand (by time, user, or event) so you can answer questions and investigate incidents.
• Be able to generate a report from those logs for a review or an after-the-fact investigation.
• Never alter the originals — reduction and reporting work on copies or views; the raw records keep their content and time order.
• Keep the time ordering intact so a reviewer can see what happened, in sequence.
• Do the reduction on a system that cannot quietly rewrite the source logs.

Framework mapping

• NIST CSF 2.0 — PR.PS-04 — Log records are generated and made available for continuous monitoring
• CIS Controls v8 — Control 8 — Audit Log Management

How to move it toward Implemented

• Use the journal’s built-in filtering for on-demand review: journalctl --since, --until, -u <service>, and _UID=.
• Generate a report to a dated file (for example journalctl --since "7 days ago" > /root/reports/audit-$(date +%F).txt) so the summary sits separate from the untouched source logs.
• Ship logs to a separate collector (rsyslog forwarding or a central log host) so reports are built without editing the originals on this server.
• Attach a sample report as hardening evidence on the asset, naming AU-7 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.