Audit controls with records your assessor can test
Collect, protect, analyze and keep the audit records your baseline asks for.
Requirements
| Clause | What it asks | ARRTECH |
|---|---|---|
| AU-2 | Event logging for defined event types. | Classified events. → |
| AU-9 | Audit information protected. | A signature chain that breaks on change. → |
| AU-9(3) | Cryptographic protection of audit information. | Hashed, signed, chained files. → |
| AU-6(3) | Correlate audit record repositories. | Correlation across sources. → |
| AU-11 | Audit records retained. | Retention set per source. → |
| IR-5 | Incidents tracked and documented. | Case records. → |
| CM-8 | A system component inventory. | Endpoint inventory with changes. → |
| MP-7 | Media use restricted. | Device control. → |
Events
Record events in one form
ARRTECH SIEM classification rules turn vendor codes into common event categories, graded Informational to Critical, so one search covers every vendor. MITRE ATT&CK tactic and technique are columns on each classified event.
Protection
Protect audit information from change
ARRTECH SIEM hashes and signs every write and chains each signature file to the one before, so a changed or missing file breaks the chain. Any source exports with a standalone verification tool, so your assessor checks it without your SIEM.
Analysis
Link events across sources
ARRTECH SIEM correlation rules link related events across sources. Ready reports and dashboards cover FISMA/NIST, and any saved query becomes a report, on a schedule.
Incidents
Track every incident to its close
A case carries its type, severity, assignee, SLA, MITRE tactic and kill-chain phase, sub-cases and history, and downloads as a case report. ARRTECH SOAR opens incidents from SIEM alerts and keeps an execution history of playbook runs. The Operator node emails a person with up to five options and waits.
Assets
Know every device and its changes
The ARRTECH DLP agent records hardware and software inventory with changes, logins and failed logins, and local user and group changes. Device control blocks removable media by class or serial number.
Limits
Know what stays with you
No ARRTECH product produces the record for these requirements.
AU-8
Time stamps from a reliable clock. No ARRTECH product sets or records time synchronization. The record comes from your time servers’ configuration.
IA-2(1)
MFA for privileged accounts. ARRTECH does not claim MFA to its consoles. The record comes from your identity system.
SC-13, SC-28
Cryptographic protection and protection at rest. ARRTECH does not claim FIPS 140-3 validated cryptography. ARRTECH does not claim encryption at rest in its products.
FedRAMP
Authorization for cloud services. ARRTECH holds no FedRAMP authorization.
By rule
Naming a clause is not a claim of certification.
AU-2
Identify the event types the system can log. ARRTECH: classification rules turn vendor codes into common event categories.
AU-9
Protect audit information and audit logging tools from unauthorized access, modification and deletion. ARRTECH: a signature chain that breaks on change, and role-based rights per log source.
AU-9(3)
Use cryptographic mechanisms to protect the integrity of audit information. ARRTECH: every write hashed and signed, with signature files chained and timestamped daily.
AU-6(3)
Analyze and correlate audit records across repositories. ARRTECH: correlation rules across sources.
AU-11
Retain audit records for the period your organization defines. ARRTECH: retention set per source or per group.
IR-5
Track and document incidents. ARRTECH: case records with type, severity, assignee, SLA and history.
CM-8
Develop and maintain an inventory of system components. ARRTECH: DLP hardware and software inventory with changes.
MP-7
Restrict the use of types of system media. ARRTECH: device control by class, vendor, product or serial number.
Questions
Does signing meet AU-10?
AU-10 is about an individual not denying an action. The SIEM’s signing maps to AU-9 and AU-9(3), protection of audit information.
Is there a ready FISMA report?
Yes. Ready reports and dashboards cover FISMA/NIST. Check each report against your baseline.
Can our assessor check the logs without ARRTECH?
Yes. Any source exports with its signatures, the SIEM certificate and a standalone verification tool.
Does ARRTECH grant an authorization to operate?
No. A senior agency official authorizes your system.
Sources
Guide
What is NIST 800-53?
The catalog of security and privacy controls for federal information systems. Rev. 5 is current.
What is FISMA?
The federal law that requires agencies to secure their information systems, using NIST standards.
Who authorizes a federal system?
A senior agency official grants the authorization to operate. NIST does not endorse any program or tool.
Next steps
Spot unusual behavior early. Learns what normal looks like for every user, computer and application from your SIEM, and flags what changes.
Get the evidence fast. Investigates each finding with read-only queries and hands a person the evidence. It never approves its own work.
Prove every log. Collects and signs logs from more than 500 source types and links related events, with a verification tool for every export.
Keep sensitive data in. Checks email, uploads, USB drives and AI prompts before sensitive data leaves the computer.
Respond with a person in charge. Runs incident response steps through your existing tools, with a person approving each decision.
