Subcontrol 6.5

[adammontville]

Ensure that appropriate [either delete this or define it] logs are being aggregated to a central log management system for analysis and review.

Measures

M1 = size of logs aggregated to central log management system
M2 = Size of total required/appropraite logs

Metrics

Coverage(Quality Measure)[0-1] =  M1 / M2

[apiperCIS]

Inputs 1) List of logs designated to be aggregated in a central log management system. At a minimum, for each log, this should include the originating system, type of log, and any other information needed to properly identify the log. 2) Approved configuration(s) for the central log management system and originating systems to ensure that each of these designated logs are sent to the central log management system

Operations 1) For each log in Input 1, check the appropriate configurations for the central log management system and/or the originating system from Input 2 to see if the approved configurations are in place for that log to be aggregated. Use this information to make a list of logs whose corresponding settings are properly configured (M1) and a list of logs whose corresponding settings are not properly configured (M2) noting the deviations from the approved configurations.

Measures M1: List of logs whose corresponding settings are properly configured for log aggregation M2: List of logs whose corresponding settings are not properly configured for log aggregation M3: Count of logs whose corresponding settings are properly configured for aggregation (count of M1) M4: Total count of logs designated for log aggregation (count of Input 1)

Metrics Ratio of logs whose corresponding settings are properly configured for log aggregation: M3 / M4

[wmunyan]

Inputs:

• The total number of log producers (M1)
• The number of sensors correlated in a central service (M2)

Operations:

• N/A

Measures:

• M1 = The total number of log producers
• M2 = The number of sensors correlated in a central service

Metrics:

• Quality of Log correlation/aggregation [0,1] = M2 / M1