AU.2.005 — Correlate Audit Review, Analysis, and Reporting

What AU.2.005 means in plain English

When something suspicious happens—a login at 2 AM, a huge file download, a failed access attempt—you should not be looking at five separate systems in five separate places. The goal here is to connect the dots between your Windows logs, your M365 logs, your firewall logs, and your physical access records so you can see the whole picture. For a small shop, this can be as simple as a weekly 10-minute review of all logs together using a free SIEM or a shared spreadsheet log, and a written process for how you would investigate if you found something alarming.

The assessment question

“Is there a documented process for correlating audit logs across multiple systems to investigate suspicious activity, and is there evidence of regular log reviews being performed?”

How to implement AU.2.005

1. Define which log sources you have: Windows Event logs, Microsoft 365 Unified Audit Log, firewall logs (router syslog), physical access (door key log or badge swipe if applicable). List them in a one-page "Log Source Inventory."
2. Establish a weekly log review procedure. Even a 10-minute weekly scan is sufficient for a small shop. The reviewer checks for: failed logins (Event ID 4625), after-hours access, large file transfers, and disabled accounts accessing systems. Document the review in a simple log review logbook (date, reviewer, findings, actions taken).
3. Consider deploying Wazuh (free SIEM) on an inexpensive VM or spare PC. Wazuh can ingest Windows events, M365 logs via API, and network device syslog, then correlate them in a single dashboard with built-in correlation rules.
4. For M365: use the Microsoft Purview Audit search to run cross-workload queries—search for a specific user across Exchange, SharePoint, and Teams simultaneously to correlate activity.
5. Document a simple incident investigation procedure: "If unusual activity is found during log review, the reviewer will: (1) document the finding, (2) pull correlated logs from all relevant sources for the same time window, (3) escalate to [Owner Name] within 4 hours."

Evidence your assessor will ask for

• Log source inventory listing all systems generating audit records
• Completed log review logbook showing dated weekly reviews with reviewer name and findings
• Written procedure for correlating logs during an investigation
• Evidence of at least one example of cross-system log correlation (e.g., a sample query result or SIEM dashboard screenshot)

More Audit & Accountability controls