Collecting logs is the easy half. AU-6 asks whether anyone looks at them, what they look for, and who hears about it.
NIST SP 800-53 Rev 5 binds US federal systems, and others through contract. For other organizations it is a reference.
What the control asks
Review and analyze system audit records at a frequency you define for indications of inappropriate or unusual activity you define, and for the potential impact of that activity. Report findings to defined personnel or roles. Adjust the level of review and reporting when risk changes, based on law enforcement information, intelligence or other credible sources.
What it means in practice
NIST's guidance says the scope covers security and privacy related logging, including account usage, remote access, wireless connections, mobile devices, configuration settings, component inventory, maintenance tools, physical access and communications at system interfaces. Findings can go to the incident response team, the help desk or security and privacy offices.
You do not need a large operations center. You need a defined routine. For example, a weekly review of failed sign ins, privilege changes and new administrator accounts, plus automated alerts for the worst patterns.
The last clause is easy to miss. When a new advisory or a known campaign raises risk, you increase review. That is something you can demonstrate with a ticket that says so.
The record lists eight enhancements: AU-6.1 Automated Process Integration, AU-6.2 Automated Security Alerts, AU-6.3 Correlate Audit Record Repositories, AU-6.4 Central Review and Analysis, AU-6.5 Integrated Analysis of Audit Records, AU-6.6 Correlation with Physical Monitoring, AU-6.7 Permitted Actions and AU-6.8 Full Text Analysis of Privileged Commands. Most small teams get the biggest return from AU-6.1 and AU-6.2: automate detection and send alerts.
Evidence to collect
- A review procedure naming the frequency and the unusual activity you look for.
- Dated review records: tickets, checklists or sign offs.
- Detection rules or saved searches with their owners.
- Reports sent to the named recipients.
- A case where findings led to action.
- A record of increased review after a risk change.
Common gaps
- Logs gathered but reviewed only after an incident.
- A review process that exists on paper with no dated output.
- Detection rules nobody has tuned, producing noise that gets ignored.
- No defined list of what counts as unusual.
- Findings never reported to anyone.
How to implement it
Start with a short list of suspicious patterns: repeated failed sign ins, sign in from new locations for admins, privilege escalation, disabled logging, mass downloads. Turn each into an alert or a saved search. Assign a reviewer for each week and a place to record outcomes. Send a monthly summary to a named person.
Walk through how an alert becomes a handled issue in the demo below.
Click through it at your own pace, or open it full screen.
Quick check
Is an automated alert enough for AU-6?
It is a strong part of it, but the control also asks for review and analysis and reporting of findings. Keep records of both the alerts and the human follow up.
How often must we review?
NIST leaves the frequency to you. Pick one you can keep and write it down.
