NIST SP 800-53 Rev. 5 · Audit and Accountability
AU-12 on Microsoft Sentinel
Required audit logging not enabled — a published KQL query you can run against Microsoft Sentinel / Log Analytics, with the evidence it needs, the settings you decide, and what a result does and does not establish.
Why this matters
A system that is supposed to be recording events and is silently recording nothing
Organizations decide which systems must keep an event record, and then assume the arrangement holds. Recording breaks quietly: an agent stops running, a setting is lost during a rebuild, a new system is created without it. Nothing raises an alarm, because the absence of records looks identical to the absence of activity.
Why this check earns its place. Silence is the hardest failure to notice, because there is nothing to see. This check compares what should be reporting against what actually is, which is the only way the gap becomes visible.
- What it reads
- The organization's own list of systems that must keep records, compared against what is actually arriving.
- What it reports
- Systems declared as requiring an event record that have produced none during the period examined.
See related public disclosures on the Signals page →
What this finds
Asset declared as requiring audit logging is producing no observed telemetry in the observation window.
The requirement
The organization must provide audit record generation capability for the event types the system is capable of auditing, on all components that require auditing.
NIST SP 800-53 Rev. 5 — AU-12 (Audit Record Generation).
NIST requires audit generation on components that require auditing. Which components those are is an organizational decision, supplied here through the asset inventory's logging_required flag. The platform cannot infer it.
How this maps to the CISA performance goals
The Cross-Sector Cybersecurity Performance Goals are a voluntary baseline published by CISA — the U.S. federal agency for critical-infrastructure cybersecurity — written for organizations too small to employ security staff. This control speaks to:
- 3.Q — Maintain log collection & storage
The goal requires the relevant logs to exist; the pack finds required logging not enabled. - 4.B — Identify adverse events
Adverse events cannot be identified from telemetry that was never recorded.
See the full coverage map, including the goals no query can answer →
Evidence this query needs
Asset inventory asset_inventory.csv
Declares which assets are in scope and what is required of them. A backup that never ran on an asset you did not know existed produces no alert — absence of evidence is invisible without an inventory to compare against.
Minimum fields: asset_id, environment, criticality
Three fields let you scope the checks. The backup_required and logging_required flags are what make the absence checks possible — without them the tool cannot tell an asset that should be backed up from one that should not.
The query
Published as au-12-logging-coverage.azure.kql. Reads AssetInventory_CL (supplied), AzureDiagnostics, AzureActivity. Requires: Log Analytics Reader.
Before this returns anything,
AzureDiagnostics, AzureActivity have to be reaching Microsoft Sentinel / Log Analytics, and AssetInventory_CL (supplied) has to be landed there. If not, the query reports nothing found — which looks
exactly like nothing wrong. What has to be switched on first →
// AU-12 -- in-scope assets producing no audit telemetry
// Compares the supplied inventory against observed diagnostic data.
let ObservationWindow = 3d;
let GraceHours = 48;
let InScope =
AssetInventory_CL
| where TimeGenerated > ago(2d)
| summarize arg_max(TimeGenerated, *) by AssetId_s
| where tobool(LoggingRequired_b) == true
| project AssetKey = tolower(AssetId_s), AssetName_s,
Environment_s, Criticality_s, Owner_s;
let Observed =
union isfuzzy=true
(AzureDiagnostics | where TimeGenerated > ago(ObservationWindow)
| project AssetKey = tolower(ResourceId)),
(AzureActivity | where TimeGenerated > ago(ObservationWindow)
| project AssetKey = tolower(ResourceId))
| summarize LastSeen = count() by AssetKey;
InScope
| join kind=leftouter Observed on AssetKey
| where isnull(LastSeen) or LastSeen == 0
| project AssetKey, AssetName_s, Environment_s, Criticality_s, Owner_s,
SourceSystem = "Azure Monitor"
| order by Criticality_s ascOpen this pack on Microsoft Sentinel to adjust the settings and download it →
The interactive version opens on Microsoft Sentinel — the platform on this page — even if your environment profile does not list it.
Settings you decide
NIST states the objective and leaves these to your organization. The interactive version of this pack applies them to the query for you.
- Observation window (days) (default 3)
- An in-scope asset producing no telemetry across this window is reported.
- Limit to specific assets (optional)
- Paste asset identifiers, one per line.
Running it continuously
Sentinel scheduled analytics rule
Rule type: Scheduled query rule
Run frequency: Every 24 hours
Lookup period: Last 3 days
Trigger: Number of query results > 0
Entity mapping: AzureResource -> AssetKey
Severity: High
Incident: Create incident, group by Owner
Suppression: 3 days per asset
Tuning note: Exclude assets within the 48h creation grace periodThis is an absence check — it looks for assets that should be producing telemetry and are not. Absence checks are only as good as the inventory, which is exactly why the inventory is a declared input rather than an assumption.
What a result does not prove
Absence of telemetry may reflect an inventory error, a routing change, or a genuinely idle asset rather than disabled logging. This check identifies where audit coverage cannot be evidenced — not where it definitively fails.
Validation status for this platform: Not tenant-validated. Structure, query generation, and preflight are covered by the project's automated test suites. This pack has not been executed against a live tenant, account, or index. Validate it in a non-production scope before relying on any result.
Before you act on a result
- Is the asset genuinely in scope, or is the inventory flag wrong?
- Was the asset created inside the grace period?
- Is telemetry flowing to a destination this query does not read?
- Has the asset been decommissioned without the inventory being updated?
Common questions
- How do I check for required audit logging not enabled in Microsoft Sentinel?
- Run the published KQL query on this page against Microsoft Sentinel / Log Analytics. It reads AssetInventory_CL (supplied), AzureDiagnostics, AzureActivity and reports: Asset declared as requiring audit logging is producing no observed telemetry in the observation window.
- What permissions are needed to run this Microsoft Sentinel query?
- Log Analytics Reader.
- What evidence does AU-12 need that Microsoft Sentinel cannot produce?
- Asset inventory (asset_inventory.csv). Declares which assets are in scope and what is required of them. A backup that never ran on an asset you did not know existed produces no alert — absence of evidence is invisible without an inventory to compare against. At minimum it must carry: asset_id, environment, criticality.
- Does a result from this query mean the control has failed?
- Absence of telemetry may reflect an inventory error, a routing change, or a genuinely idle asset rather than disabled logging. This check identifies where audit coverage cannot be evidenced — not where it definitively fails.
Terms used on this page
- NIST SP 800-53the U.S. federal catalogue of security requirements
- The catalogue of security and privacy requirements published by the National Institute of Standards and Technology, a U.S. federal agency. U.S. government systems are measured against it, and many private organizations adopt it voluntarily. Each requirement has an identifier such as AC-2. Official source →
- CISACybersecurity and Infrastructure Security Agency
- The U.S. federal agency responsible for national critical-infrastructure cybersecurity. Its publications are works of the U.S. government and are free to use. Official source →
- KQLKusto Query Language
- The language used to ask questions of data held in Microsoft Sentinel. A query written in it is text, like a spreadsheet formula, and can be read before it is run.
- CPGCross-Sector Cybersecurity Performance Goals
- A voluntary baseline of security practices published by the U.S. Cybersecurity and Infrastructure Security Agency, written specifically for organizations too small to employ security staff. It is a short, plainly written starting list rather than a full standard. Official source →
- not tenant-validatednever executed against real data
- The check has passed the project's automated tests for structure and syntax, but has never been run against real data anywhere. Test it in a safe scope before relying on any result.
The same control on other platforms
- AU-12 on AWS — SQL (Athena) + Lambda
- AU-12 on Splunk — SPL
- All platforms for AU-12