documentation_complete: true

title: 'Ensure Auditing Policy Exists'

description: |-
    In order to effectively audit and review system logs,
    an audit policy should be written to identify data and trends of
    interest.

rationale: |-
    Without a comprehensive audit policy and review procedures,
    organizations risk missing critical events or event trends within
    their environment. These missed events may indicate system anomalies
    ranging from malicious attacks, system instabilities, system misuse,
    etc.

severity: medium

identifiers:
    cce: jboss_karaf-auditing_policy

references:
    cis: ""
    disa: ""
    nist: AU-1,AU-2,AU-3,AU-5

ocil_clause: 'no auditing policy exists'
