Automated Log Review

Applies to. Applies to the review that 10.4.1 requires at least once daily: all security events, the logs of components that store, process or transmit cardholder data or sensitive authentication data, the logs of critical system components, and the logs of components performing security functions. 10.4.1.1 requires that review to be carried out by automated mechanisms, and the assessor examines the mechanisms themselves and interviews the people who use them. 10.7.2 lists the audit log review mechanism among the critical security control systems whose failure must be detected, alerted and addressed promptly.

Example. A hosting provider's log platform takes in events from firewalls, intrusion-detection sensors, database servers and the payment API. Correlation rules raise an alert for repeated failed logins to a privileged account, an administrator account created outside a change window, and a bulk export from a database server that never exports data. An analyst works through the alerts each morning instead of paging through millions of raw entries.

Limits. Automation does not remove the person: 10.4.1.1 automates the review, and 10.4.1.b still has the assessor observe the process and interview personnel to confirm the listed logs are reviewed daily, so someone has to act on what the mechanism raises. Collection is not review: a log server that stores every entry but has no rules, alerts or reports does not perform an audit log review. The requirement names no technology: a SIEM is one way to meet it, but scripts, a log analytics service or a managed detection service satisfy 10.4.1.1 just as well if they cover the log sources in 10.4.1.