References

Retention · Appendix B item 1 · current (May 22 2026) · read 2026-11-01

Retained logs must be actively searchable for a minimum of 6 months after creation. They must be retrievable for a year after creation.

Timestamp · Appendix B item 3 · current (May 22 2026) · read 2026-11-01

Logs must include a consistently accurate timestamp.

Identity used · Appendix B item 5(1) · current (May 22 2026) · read 2026-11-01

Determining the identity used for performing operations in applications and on systems.

Network source and destination · Appendix B item 5(2) · current (May 22 2026) · read 2026-11-01

Determining source and destination network address information, including protocols, ports, and session attributes.

Object and data events · Appendix B item 5(3) · current (May 22 2026) · read 2026-11-01

Identifying object/resource/data events for accessed, modified, or destroyed items.

Privilege changes · Appendix B item 5(4) · current (May 22 2026) · read 2026-11-01

Identifying actions that affect changes to privilege levels.

Infrastructure changes · Appendix B item 5(5) · current (May 22 2026) · read 2026-11-01

Identifying changes to IT/OT/IoT infrastructure (add/remove/modify endpoints).

Security tooling alerts · Appendix B item 5(6) · current (May 22 2026) · read 2026-11-01

Monitoring for suspicious activity identified by security tooling (e.g., intrusion detection systems, endpoint protection platforms, security gateways, etc.).

Indicators of compromise · Appendix B item 5(7) · current (May 22 2026) · read 2026-11-01

Monitoring, detecting, and hunting for known indicators of compromise.

Anomalous activity · Appendix B item 5(8) · current (May 22 2026) · read 2026-11-01

Monitoring, detecting, and hunting for anomalous system or user activity.

Data affected · Appendix B item 5(9) · current (May 22 2026) · read 2026-11-01

Determining the quantity and types of data affected during an incident.

Attack vectors and lateral movement · Appendix B item 5(10) · current (May 22 2026) · read 2026-11-01

Determining the attack vector(s) of a cybersecurity attack, including any associated with initial access, as well as lateral movement.

Automated alerts · Appendix B item 5(11) · current (May 22 2026) · read 2026-11-01

Generating appropriate automated alerts for all of the above.

Improving the Federal Government's Investigative and Remediation Capabilities · whole memo · rescinded (by M-26-14 on May 22 2026) · read 2026-11-01

Historical reference only. Its Appendix C listed log categories by criticality (EL1 to EL3) and named Windows items by type (PowerShell execution, WMI events, registry access, audit log cleared) and Linux/macOS log file paths; it listed no event IDs.

Logging Reference Architecture (implements M-26-14) · whole document · current (Aug 20 2026); summarized from secondary sources · read 2026-11-01

Nine telemetry categories defined by minimum usable fidelity and six common fields (timestamp, event type, identity, resource, outcome, provenance). Names no event IDs. Agency logging plans are due about 90 days after publication.

Priority enterprise log sources · Best Practices for Event Logging and Threat Detection (Aug 2024) · current · read 2026-11-01

Prioritized list of 16 enterprise log sources, 3 OT and 7 cloud log sources (quoted in the links table).

Process creation and command-line auditing · Best Practices for Event Logging and Threat Detection (Aug 2024) · current · read 2026-11-01

Always enable detailed logging that includes process creation events and command-line auditing.

PowerShell logging · Best Practices for Event Logging and Threat Detection (Aug 2024) · current · read 2026-11-01

Ensure that logging captures command execution, script block logging and module logging for PowerShell.

Expanded Microsoft 365 audit operations · Microsoft Expanded Cloud Logs Implementation Playbook (Jan 2025) · current · read 2026-11-01

Names the Exchange, SharePoint and Teams operations Microsoft made available to E3/G3 and above following its agreement with CISA (listed in the links table). SearchQueryInitiatedExchange and SearchQueryInitiatedSharePoint require activation.

Web shell eviction countermeasure · Eviction Strategies Tool, CM0106 Eliminate Web Shells · current · read 2026-11-01

Compare files on the web server with a known-good version; detect anomalous user agents, referrer headers and IPs in web server logs; detect unexpected network flows. Logs to preserve: OS, web application, access, error, WAF, reverse proxy, CDN, DMZ firewall, database.

Event Logging · AU-2 · current · read 2026-11-01

Identify the types of events that the system is capable of logging and specify the event types for logging. Event types are organization-defined; the control names no specific events.

Content of Event Records · AU-3 · current · read 2026-11-01

Event records contain what type of event occurred, when, where, the source, the outcome, and the identity of any individuals, subjects, or objects/entities associated with the event.

Audit Record Review Analysis and Reporting · AU-6 · current · read 2026-11-01

Review and analyze system audit records for indications of inappropriate or unusual activity.

Audit Record Retention · AU-11 · current · read 2026-11-01

Retain audit records for an organization-defined time period consistent with records retention policy.

Audit Record Generation · AU-12 · current · read 2026-11-01

Provide audit record generation capability for the event types the system is capable of auditing on organization-defined system components.

Log records are generated and made available for continuous monitoring · PR.PS-04 · current · read 2026-11-01

Log records are generated and made available for continuous monitoring.

Cybersecurity Log Management Planning Guide · initial public draft · draft (Oct 2023; not final) · read 2026-11-01

Draft guidance on log management planning. The 2006 SP 800-92 remains the final version.

Advanced audit policy requirements · Microsoft Windows 11 V2R11 (2026-10-05) · current · read 2026-11-01

Rules WN11-AU-* require specific Advanced Audit Policy subcategories for Success and/or Failure; WN11-CC-000066 requires command line data in process creation events; WN11-CC-000326/000327 require PowerShell script block logging and transcription.

Advanced audit policy requirements · Microsoft Windows Server 2022 V2R11 · current · read 2026-11-01

Rules WN22-AU-* and WN22-DC-* require specific Advanced Audit Policy subcategories for member servers and domain controllers; WN22-CC-000090 requires command line data in process creation events; WN22-CC-000460/000530 require PowerShell script block logging and transcription.

Advanced audit policy requirements · Microsoft Windows 10 V3R6 (2026-01-23) · current · read 2026-11-01

Rules WN10-AU-* require specific Advanced Audit Policy subcategories for Success and/or Failure; WN10-CC-000066 requires command line in process creation events; WN10-CC-000326/000327 require PowerShell script block logging and transcription.

Advanced audit policy requirements · Microsoft Windows Server 2019 V3R9 (2026-07-10) · current · read 2026-11-01

Rules WN19-AU-* and WN19-DC-* require specific Advanced Audit Policy subcategories for member servers and domain controllers; WN19-CC-000090 requires command line in process creation events; WN19-CC-000460/000530 require PowerShell script block logging and transcription.

Advanced audit policy requirements · Microsoft Windows Server 2025 V1R1 (2026-02-27) · current · read 2026-11-01

Rules WN25-AU-* and WN25-DC-* require specific Advanced Audit Policy subcategories; adds Account Lockout successes (WN25-AU-000150) and Directory Service Changes failures (WN25-DC-000270) relative to Server 2022; WN25-CC-000090/000460/000530 require command line in process creation, script block logging and transcription.

Web server logging requirements · Microsoft IIS 10.0 Server V3R7 (2026-02-26) · current · read 2026-11-01

IIST-SV-000103: log file and ETW both enabled. IIST-SV-000110: W3C format with Connection and Warning request headers (outcome). IIST-SV-000111: W3C format with User Agent, User Name, Referrer, Authorization request header and Content-Type response header (identity). IIST-SV-000115/000116/000145: log protection, backup, storage capacity.

Web site logging requirements · Microsoft IIS 10.0 Site V2R15 (2026-02-26; V2R16 reported by a scanner vendor, unconfirmed) · current · read 2026-11-01

IIST-SI-000206: log file and ETW both enabled per site. IIST-SI-000208: behind a load balancer or proxy, log the client IP (X-Forwarded-For accepted). IIST-SI-000209/000210: W3C format with the outcome and identity fields as in the Server STIG. IIST-SI-000238: storage capacity.

Web server logging requirements · Apache Server 2.4 UNIX Server V3R3 (2026-05-28) and UNIX Site V2R7 · current · read 2026-11-01

AS24-U1-000065: CustomLog enabled. AS24-U1-000070 and AS24-U2-000090: log_config_module loaded with LogFormat %a %A %h %H %l %m %s %t %u %U %{Referer}i. AS24-U1-000130: client IP behind a proxy (mod_remoteip). AS24-U1-000630: LogLevel info or below. AS24-U1-000160/000180/000190/000210/000710: alerting on failure, access, protection, backup, capacity.

Web server logging requirements · Apache Server 2.4 Windows Server V3R4 and Windows Site V2R3 (2026-04-01) · current · read 2026-11-01

AS24-W1-000065/000070/000090: CustomLog, log_config_module and LogFormat %a %A %h %H %l %m %s %t %u %U %{Referer}i. AS24-W1-000130: client IP behind a proxy. AS24-W1-000760: timestamps (%t) mappable to UTC at one-second granularity. AS24-W1-000160 to 000740: alerting, access, protection, backup, capacity, SIEM integration. The Windows Site STIG V2R3 removed its logging rule (V-214364).

Audit rules (auditd) · Red Hat Enterprise Linux 9 V2R10 (2026-10-05) · current · read 2026-11-01

Rules RHEL-09-654010 to 654255 require auditd rules for privileged execve, permission and ownership changes (chmod, chown, setxattr families), deletions (rename, unlink, rmdir), failed access (open, openat, creat, truncate with EPERM/EACCES), kernel module changes, mount and umount, privileged commands (sudo, su, passwd, usermod, crontab, ssh-agent and others) and watches on identity files (/etc/passwd, shadow, group, sudoers, faillock, lastlog). RHEL-09-653100 requires log_format ENRICHED.

Audit flags (OpenBSM) · Apple macOS 15 (Sequoia) V1R8 (2026-10-05) · current · read 2026-11-01

APPL-15-001003 requires security auditing enabled; APPL-15-001001/001002/001044 require the ad, lo and aa flag classes; APPL-15-001020 to 001024 require -fd, fm, -fr, -fw and -ex (failures of deletion, read, write and execution; all attribute modifications); APPL-15-001029 requires 7-day retention. Apple has deprecated the OpenBSM audit subsystem; the STIG still requires it.

Recommended Windows events to forward · Event Forwarding Guidance (RecommendedEvents.csv) · published 2019; CC0 · read 2026-11-01

168 recommended Windows events by category (account usage, network policy, software installation, PowerShell, Defender, AppLocker, task scheduler, firewall, and others). The repository says its lists are more current than the 2013 paper 'Spotting the Adversary with Windows Event Log Monitoring'.

Events to monitor with potential criticality · Appendix L: Events to Monitor (Windows Server AD DS best practices) · current Microsoft guidance · read 2026-11-01

Microsoft's own list of Windows security events worth monitoring, each with a potential criticality of High, Medium or Low.

Baseline and stronger audit policy recommendations · Audit policy recommendations (Windows Server security best practices) · current Microsoft guidance · read 2026-11-01

Microsoft's baseline and stronger recommendations per Advanced Audit Policy subcategory for workstations, member servers and domain controllers.

Audit Log Management · Control 8 · current · read 2026-11-01

12 safeguards covering audit log collection, DNS, URL and command-line logs; 8.10 requires 90-day retention. Names no event IDs.

Log and monitor all access to system components and cardholder data · Requirement 10 · current · read 2026-11-01

10.2.1.1 to 10.2.1.7 name event categories (access to cardholder data, administrative actions, audit log access, invalid logical access attempts, credential changes, audit log initialization and changes, system-level object creation and deletion). Retention 12 months with 3 months immediately available. Names no event IDs.

Audit and Accountability · 3.3.1 to 3.3.9 · current (DFARS rule effective Nov 10 2025) · read 2026-11-01

Organization-defined audit events. Names no specific events.

Web shell detection guidance · Detect and Prevent Web Shell Malware (CSI PP-20-0901, April 2020) · current · read 2026-11-01

Names the detection sources: web server access logs (anomalous user agents, missing or unusual referers, off-peak access, URIs accessed by few clients); comparison of web application files against a known-good copy; unexpected network flows from web servers; Sysmon Event ID 1 and auditd records of the web server process spawning children (it is uncommon for most benign web servers to launch the ipconfig utility).

Web shell guidance · Web Shells: Threat Awareness and Guidance (2015) · current · read 2026-11-01

A web shell is generally only visited by the creator resulting in limited user-agent variants; frequency analysis on the web access logs could indicate the location of a web shell; any evidence of suspicious shell commands, such as directory traversal, by the web server process; monitoring for changes to servable content with a file integrity system.

Application events to log · Logging Cheat Sheet · current · read 2026-11-01

Always log: input validation failures, output validation failures, authentication successes and failures, authorization failures, session management failures, application errors and system events, start-ups and shut-downs, use of higher-risk functionality (file uploads, admin privilege use, requests with an unexpected HTTP verb), legal opt-ins, suspicious business logic activity.

Web server logging requirements (product-neutral) · Web Server Security Requirements Guide V4R5 (2026-07-10) · current · read 2026-11-01

SRG-APP-000089/000092/000095 to 000100 WSR: log startup and shutdown, access and authentication; record event type, date and time, location within the server, source (client IP, also behind a proxy), outcome, and user identity. SRG-APP-000116/000374/000375: internal clock, UTC mapping, one-second granularity. SRG-APP-000108/000118 to 000125/000357 to 000359: alerting, access, integrity, backup, capacity, audit log server.

Audit logging policies · Secure Cloud Business Applications, Microsoft 365 Defender baseline, MS.DEFENDER.6 Audit Logging · current (policy 6.1 last modified March 2025; 6.3 June 2023) · read 2026-11-01

MS.DEFENDER.6.1v1: Unified Audit logging SHALL be enabled. MS.DEFENDER.6.3v1: Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (note: M-21-31 was rescinded by M-26-14 in May 2026; the baseline text had not been updated as of this read). The policy note describes retaining Exchange Online, SharePoint Online, OneDrive for Business and Microsoft Entra ID audit records for one year.