AU.L2-3.3.6Reduction & Reporting
Provide audit record reduction and report generation to support on-demand analysis and reporting.
[a]
an audit record reduction capability that supports on-demand analysis is provided; and[b]
a report generation capability that supports on-demand reporting is provided.
Saved searches and a scoped assessor report instead of multi-gigabyte CSV dumps
Implementation
AO coverage. Addresses both Reduction & Reporting objectives: an audit record reduction capability supporting on-demand analysis, and a report generation capability supporting on-demand reporting.
Reduction [a]. Analysts work through saved searches with parameters for time range, user, host, and event class, so a question like what did this account do in the enclave last Tuesday is a form to fill in rather than a query to write. Summary indexes pre-aggregate the high-volume sources (authentication outcomes per account per hour, file-share read volume per user per day) so a multi-month question returns in seconds instead of scanning raw events.
Reporting [b]. A report library covers the questions we are actually asked: privileged activations with ticket reconciliation, failed authentication trends, enclave file-share access by user, silent-source history, and log-admin activity. Each renders on demand and exports to PDF or CSV with the query, the time range, and the run timestamp printed on it, so a reviewer can see how the numbers were produced.
Scoping matters. Reports are scoped to the enclave systems in the assessment boundary. Exports land on an access-controlled evidence share with a retention date, and anything containing CUI-adjacent detail is marked and handled accordingly rather than emailed.
Maintenance. Quarterly test that each report in the library still runs after schema or platform changes. Report definitions are version-controlled with the query text, so a report can be re-run against a past window and reproduce the same result.
Accepted gap. One source is queried through a slower archive tier, so its reports run as a scheduled job rather than truly on demand; requests against that source are answered within one business day, and the constraint is stated up front instead of discovered mid-assessment.
What the evidence looks like
- Saved search library with parameter definitions
- Summary index or aggregation configuration for the high-volume sources
- Sample generated report showing query, time range, and run timestamp
- Evidence share permissions and retention settings
- Quarterly report-validation checklist
Environment
Tools
Was this example useful?
Quick reaction — no account needed. For reasoning that moves the community meter, cast a full verdict below.
Discussion(0)
No discussion on this example yet
Verdicts capture a conclusion. Use a thread when the interesting part is the argument.
Sign in to start a thread.