SOX-COSO Deployment Guide – Configure the Compliance Module

LogRhythm requires that you configure some objects included in the SOX COSO Compliance Package. This section describes the steps you must perform.

Enable Intelligent Indexing

Intelligent Indexing allows Reports, Investigations, and Tails to keep the appropriate log data online in the Log Manager. Care must be taken when choosing which object to allow Intelligent Indexing as broad criteria can cause an exceptional amount of online data and overwhelm the Log Manager. For a list of Intelligent Indexing-capable objects and their recommended setting, see SOX-COSO—Reports.

Configure LogRhythm Data Management Settings

LogRhythm Compliance Packages rely on log data to be forwarded to various LogRhythm databases in order for the reports to properly populate and for proper archiving as dictated by the regulation. To ensure log data is being forwarded to the required databases, follow the data management steps outlined in Find More Information.

Classify Assets into Log Source Lists

Each SOX COSO compliance-relevant log source must be classified into one of the NRC Log Source Lists. To see recommendations for which Technology Association may fall under which SOX COSO Log Source List Category, see SOX-COSO—Lists.

Activate Default Alarms

All alarms included in the SOX COSO Compliance Package are disabled by default. To meet compliance requirements, they must be enabled. For more information, see Enable or Disable Alarm Rules. In some cases, additional customization may be required to minimize false alarms.