Title: The DBMS must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
Vulnerability ID: V-32373
IA Controls: None
Description: Information system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control includes, but is not limited to: time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application specific events, success/fail indications, file names involved, access control, or flow control rules invoked.
Success and failure indicators ascertain the outcome of a particular event. As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Without knowing the outcome of audit events, it is very difficult to accurately recreate the series of events during forensic analysis.
Check Text: Check DBMS settings and existing audit records to verify information specific to the outcome of the event is being captured and stored with the audit records. If audit records exist without the outcome of the event that occurred, this is a finding.
Fix Text: Modify DBMS audit settings to include the outcome of the event as part of the audit record.[divider]
This is to ensure you know what an action did when an audit comes up. If someone attempts to drop a table, you want to make sure you are able to confirm if that action succeeded or not. Depending on the success of an action, different steps may need to be taken to better protect, or secure the SQL Server.