{"id":16818,"date":"2026-08-03T09:12:29","date_gmt":"2026-08-03T14:12:29","guid":{"rendered":"https:\/\/www.wisconsin.edu\/uw-policies\/?page_id=16818"},"modified":"2026-10-06T12:46:50","modified_gmt":"2026-10-06T17:46:50","slug":"sys-1041-appendix-a-logging-elements-and-events","status":"publish","type":"page","link":"https:\/\/www.wisconsin.edu\/uw-policies\/sys-1041-appendix-a-logging-elements-and-events\/","title":{"rendered":"SYS 1041 Appendix A: Logging Elements and Events"},"content":{"rendered":"<p>This appendix identifies required and recommended logging elements and events for High Impact Systems under Section 6.A.II.<\/p>\n<h4><strong>Required Log Elements (Must)<\/strong><\/h4>\n<p>All required logs must include, at a minimum:<\/p>\n<ul>\n<li>User or system identifier<\/li>\n<li>Date and time<\/li>\n<li>Event type<\/li>\n<li>Success or failure status, where applicable<\/li>\n<li>Source of the event, such as IP address, device, or location<\/li>\n<\/ul>\n<h4><strong>Authentication Events (Must)<\/strong><\/h4>\n<p>The following authentication-related events must be logged:<\/p>\n<ul>\n<li>Successful and failed authentication attempts<\/li>\n<li>User logon and logoff activities<\/li>\n<li>Password, credential, or authentication changes<\/li>\n<\/ul>\n<h4><strong>Account Lifecycle Activities (Must)<\/strong><\/h4>\n<p>The following account management events must be logged:<\/p>\n<ul>\n<li>Account creation<\/li>\n<li>Account modification<\/li>\n<li>Account disabling<\/li>\n<li>Account deletion<\/li>\n<li>Changes to account roles, permissions, or access rights<\/li>\n<\/ul>\n<h4><strong>Privileged and Administrative Activity (Must)<\/strong><\/h4>\n<p>The following events must be logged:<\/p>\n<ul>\n<li>Use of privileged, administrative, or elevated accounts<\/li>\n<li>Administrative or security-sensitive activities<\/li>\n<li>Changes to privileged group memberships<\/li>\n<li>Assignment or removal of privileged access<\/li>\n<\/ul>\n<h4><strong>Security Configuration Changes (Must)<\/strong><\/h4>\n<p>The following events must be logged:<\/p>\n<ul>\n<li>Security policy changes<\/li>\n<li>Security-relevant configuration changes<\/li>\n<li>Changes to logging configurations<\/li>\n<li>Changes to authentication or access-control settings<\/li>\n<\/ul>\n<h4><strong>System and Security Events (Should)<\/strong><\/h4>\n<p>The following events should be logged where they support detection, investigation, or response activities:<\/p>\n<ul>\n<li>System start\/stop events<\/li>\n<li>System and network alerts, warnings, or error messages<\/li>\n<li>Execution of administrative scripts, scheduled tasks, or automated processes<\/li>\n<\/ul>\n<h4><strong>File and Data Access Events (Should):<\/strong><\/h4>\n<p>The following should be logged:<\/p>\n<ul>\n<li>Creation, modification, or deletion of system files<\/li>\n<li>Creation, modification, or deletion of sensitive data<\/li>\n<li>Access to files or datasets containing high risk data<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>This appendix identifies required and recommended logging elements and events for High Impact Systems under Section 6.A.II. Required Log Elements (Must) All required logs must include, at a minimum: User or system identifier Date and time Event type Success or failure status, where applicable Source of the event, such as IP address, device, or location [&#8230;]<\/p>\n","protected":false},"author":6892,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-16818","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.wisconsin.edu\/uw-policies\/wp-json\/wp\/v2\/pages\/16818","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wisconsin.edu\/uw-policies\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.wisconsin.edu\/uw-policies\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.wisconsin.edu\/uw-policies\/wp-json\/wp\/v2\/users\/6892"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wisconsin.edu\/uw-policies\/wp-json\/wp\/v2\/comments?post=16818"}],"version-history":[{"count":6,"href":"https:\/\/www.wisconsin.edu\/uw-policies\/wp-json\/wp\/v2\/pages\/16818\/revisions"}],"predecessor-version":[{"id":17044,"href":"https:\/\/www.wisconsin.edu\/uw-policies\/wp-json\/wp\/v2\/pages\/16818\/revisions\/17044"}],"wp:attachment":[{"href":"https:\/\/www.wisconsin.edu\/uw-policies\/wp-json\/wp\/v2\/media?parent=16818"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}