CIS-CSC User Guide – Reports
Policy Activity Summary
Report ID: 15
CSC Control(s): CSC 16.7
Log Sources (minimum):
Various
Log Sources (recommended):
N/A
List(s):
N/A
Description:
Lists all policy activity by Impacted Host. CIS Critical Security Control(s): CSC 16.7
Compliance: Top Attackers
Report ID: 67
CSC Control(s): CSC 12.5
Log Sources (minimum):
IDS/Security Events
Log Sources (recommended):
N/A
List(s):
N/A
Description:
Lists all attackers ordered by the number of events detected highest to lowest. CIS Critical Security Control(s): CSC 12.5
Compliance: System Critical And Error Conditions
Report ID: 84
CSC Control(s): CSC 6.7
Log Sources (minimum):
Host or Device Logs
Log Sources (recommended):
N/A
List(s):
Compliance: Network Access Control Systems
Compliance: Production Servers
Compliance: Remote Access Systems
Compliance: Wireless Access Points
Description:
Summarizes critical and error conditions for production servers and network infrastructure devices. CIS Critical Security Control(s): CSC 6.7
Rogue Host Detection Summary
Report ID: 959
CSC Control(s): CSC 1.1, CSC 1.4
Log Sources (minimum):
AI Engine Events
Log Sources (recommended):
N/A
List(s):
N/A
Description:
For use with the LogRhythm Network Monitor. This report shows a summary of all hostnames picked up by the Rogue Host alarm. CIS Critical Security Control(s): CSC 1.1, CSC 1.4
Software Installation Summary
Report ID: 1004
CSC Control(s): CSC 2.3
Log Sources (minimum):
Host Logs
Log Sources (recommended):
Endpoint Protection Logs
List(s):
N/A
Description:
This report displays the number of software installation events logged during the reporting period. CIS Critical Security Control(s): CSC 2.3
Vulnerabilities By Entity
Report ID: 1005
CSC Control(s): CSC 3.1, CSC 3.6, CSC 3.7
Log Sources (minimum):
Vulnerability Scanner Logs
Log Sources (recommended):
List(s):
N/A
Description: CIS Critical Security Control(s): CSC 3.1, CSC 3.6, CSC 3.7
Vulnerabilities By Vulnerability
Report ID: 1006
CSC Control(s): CSC 3.1, CSC 3.6, CSC 3.7
Log Sources (minimum):
Vulnerability Scanner Logs
Log Sources (recommended):
N/A
List(s):
N/A
Description: CIS Critical Security Control(s): CSC 3.1, CSC 3.6, CSC 3.7
Malware Summary
Report ID: 1007
CSC Control(s): CSC 8.1
Log Sources (minimum):
Antivirus Events
Log Sources (recommended):
Endpoint Protection Logs
List(s):
N/A
Description:
This report provides a summary of malware activity by entity and impacted host within the organization infrastructure. CIS Critical Security Control(s): CSC 8.1
Backups Completed
Report ID: 1008
CSC Control(s): CSC 10.1
Log Sources (minimum):
Backup System Events
Log Sources (recommended):
N/A
List(s):
N/A
Description:
This report provides a summary of critical failures, errors, and information from backup software. CIS Critical Security Control(s): CSC 10.1
Top Attackers Summary
Report ID: 1015
CSC Control(s): CSC 6.7, CSC 6.6
Log Sources (minimum):
IDS/Security Events
Log Sources (recommended):
N/A
List(s):
N/A
Description:
This report provides a summary of top attackers by origin host. CIS Critical Security Control(s): CSC 6.7, CSC 6.6
Top Targeted Applications
Report ID: 1019
CSC Control(s): CSC 18.10
Log Sources (minimum):
Firewall Logs
Log Sources (recommended):
Next Gen Firewall
List(s):
N/A
Description:
Lists all applications targeted for attack ordered by the number of events detected highest to lowest. CIS Critical Security Control(s): CSC 18.10
Configuration Change Summary
Report ID: 1020
CSC Control(s): CSC 11.3
Log Sources (minimum):
Host or Device Logs
Log Sources (recommended):
N/A
List(s):
N/A
Description:
This report summarizes configuration change activity (configurations deleted/disabled/enabled/loaded/modified) by Impacted Host. CIS Critical Security Control(s): CSC 11.3
Denial Of Service Summary
Report ID: 1021
CSC Control(s): CSC 9.5
Log Sources (minimum):
IDS/Security Events
Log Sources (recommended):
Next Gen Firewall
List(s):
N/A
Description:
This report provides a summary of detected denial of service attempts by Entity and Impacted Host. CIS Critical Security Control(s): CSC 9.5
Host Compromise Summary
Report ID: 1022
CSC Control(s): CSC 5.2
Log Sources (minimum):
IDS/Security Events
Log Sources (recommended):
N/A
List(s):
N/A
Description:
This report provides a summary of compromise activity by Impacted Host. CIS Critical Security Control(s): CSC 5.2
Backup Critical/Error Summary
Report ID: 1023
CSC Control(s): CSC 10.1
Log Sources (minimum):
AI Engine Events
Log Sources (recommended):
N/A
List(s):
N/A
Description:
This report provides a summary of critical failures and errors from backup software by Impacted Host. CIS Critical Security Control(s): CSC 10.1
Backup Restore Summary
Report ID: 1024
CSC Control(s): CSC 10.1, CSC 10.3
Log Sources (minimum):
Backup System Events
Log Sources (recommended):
N/A
List(s):
N/A
Description:
This report provides a summary of restore events and information from backup software. CIS Critical Security Control(s): CSC 10.1, CSC 10.3