Audit policy
2readings
0conditions
1themes fed
Livestatus
Windows audit subcategory set and framework, with a config-change occurrence when it changes.
Topic id: audit_policy.
Full inventory every day. Supported changes are reported when the agent observes them.
Fields
Which audit subcategories are recording and which audit framework reports them, with a configuration change when the set changes.
| Field | Type | Unit | Meaning |
|---|---|---|---|
sparklogs.data.audit_policy.audit_framework | string | Which audit system the policy belongs to. windows_advanced_audit is the Windows Advanced Audit Policy subcategories, the only one reported today. Reserved for other platforms: auditd (Linux audit daemon rules), openbsm (macOS BSM audit classes) and none (no audit system). Always present. | |
sparklogs.data.audit_policy.audit_events | string_array | Which events the audit policy records, sorted. Each entry is <family>[_<detail>]_<outcome>, outcome success or failure. A family entry (logon_success) is present whenever any of its subcategories records that outcome, beside each such subcategory's own entry (logon_logon_success). Families: logon, authentication, process_creation, process_termination, detailed_tracking, file_access, object_access, network, account_management, policy_change, privilege_use, system, directory_service. An empty array is a policy that was read and records nothing. Absent when the policy could not be read, preserving the previous result. Under auditd the entries will be the rule keys, with no outcome suffix; under openbsm the classes map to families: lo logon, aa authentication, ex process_creation, pc process_termination, fr/fw/fa/fm/fc/fd file_access_read/write/attribute_read/attribute_modify/create/delete, ad account_management, policy_change, privilege_use and system, nt network, ot object_access. | |
sparklogs.data.audit_policy.audit_subcategories | object_array | Every audit subcategory the OS defines, in the order auditpol lists them, category by category. Each entry has native_id, the subcategory GUID in lowercase textual form, and success and failure, whether the policy records that outcome. A subcategory this agent maps also carries audit_event (its audit_events entry without the _success or _failure outcome) and family; its native_name and native_category are the English names auditpol prints, not localized, and it carries no native_name_source. One it does not map carries no audit_event or family; its native_name and native_category come from the OS in the host's display language, with native_name_source os; each name is absent when the OS has none for it, and native_name_source stays. The three IPsec mode subcategories are three entries sharing one audit_event. The native_* members are the audit framework's own: under auditd and openbsm they will carry that framework's identifiers and names. Describes the policy and is never compared: audit_events alone decides a change. Absent when the policy could not be read, preserving the previous result. | |
sparklogs.data.audit_policy.audit_subcategories[].native_id | string | In each audit_subcategories entry. | |
sparklogs.data.audit_policy.audit_subcategories[].success | bool | In each audit_subcategories entry. | |
sparklogs.data.audit_policy.audit_subcategories[].failure | bool | In each audit_subcategories entry. | |
sparklogs.data.audit_policy.audit_subcategories[].audit_event | string | In each audit_subcategories entry. | |
sparklogs.data.audit_policy.audit_subcategories[].family | string | In each audit_subcategories entry. | |
sparklogs.data.audit_policy.audit_subcategories[].native_name | string | In each audit_subcategories entry. | |
sparklogs.data.audit_policy.audit_subcategories[].native_category | string | In each audit_subcategories entry. | |
sparklogs.data.audit_policy.audit_subcategories[].native_name_source | string | In each audit_subcategories entry. |
Changes
This topic reports what the host looks like, so its news is what CHANGED between two reports. Each change below is a named fact you can ask about across the fleet.
| Change | What it means |
|---|---|
audit_policy_coverage_reduced | Audit coverage reduced |
audit_policy_changed | Audit policy changed |
Example
Inventory (every day)
audit policy; 24 events enabled, logon success audited.
sparklogs.data.audit_policy.audit_events: ["account_management_failure", "account_management_security_group_success", "account_management_success", "account_management_user_failure", "account_management_user_success", "authentication_credential_validation_failure", "authentication_credential_validation_success", "authentication_failure", "authentication_success", "logon_account_lockout_failure", "logon_failure", "logon_logoff_success", "logon_logon_failure", "logon_logon_success", "logon_special_logon_success", "logon_success", "policy_change_audit_policy_success", "policy_change_authentication_policy_success", "policy_change_success", "system_failure", "system_integrity_failure", "system_integrity_success", "system_security_state_change_success", "system_success"]
sparklogs.data.audit_policy.audit_framework: windows_advanced_audit
SparkLogs: CONTEXT, Info, audit_policy: INVENTORY: audit policy; 24 events enabled, logon success audited.
Inventory (every day)
audit policy; 0 events enabled, logon success not audited.
sparklogs.data.audit_policy.audit_events: []
sparklogs.data.audit_policy.audit_framework: windows_advanced_audit
SparkLogs: CONTEXT, Info, audit_policy: INVENTORY: audit policy; 0 events enabled, logon success not audited.
Change set
2 changed, 2 disabled; "-logon_logon_success" "-logon_success".
sparklogs.data.audit_policy.delta_kind: changed
sparklogs.data.audit_policy.audit_events: ["account_management_success", "account_management_user_success", "logon_account_lockout_failure", "logon_failure", "logon_logon_failure", "policy_change_audit_policy_success", "policy_change_success"]
sparklogs.data.audit_policy.audit_framework: windows_advanced_audit
SparkLogs: CONTEXT, Info, audit_policy: DELTA: 2 changed, 2 disabled; "-logon_logon_success" "-logon_success".
Signal details
audit_policy_coverage_reduced
The host's audit policy changed and now records fewer Windows Security events than before.
Impact: Less is recorded than before, so evidence a later investigation needs may never exist on this host.
Where to look next:
- Compare the removed subcategories against your audit policy baseline for this host's role.
- Audit scope reductions on a server are worth a closer look; routine management-tool churn on a workstation usually is not.
Related reasons:
audit_policy_changed: the audit policy only grew, or its framework changed
audit_policy_changed
The host's audit policy changed: more Windows Security events are audited, or the audit framework changed.
Also reported by: Windows Security event log
Impact: A broader audit set means more audit volume and more coverage; nothing that was audited stopped being audited.
Where to look next:
- Compare the added subcategories against your audit policy baseline for this host's role.
- Routine management-tool churn on a workstation usually is not worth a closer look.
Related reasons:
audit_policy_coverage_reduced: an audited event disappeared from the policy