How do I check for required audit logging not enabled in Splunk?

Run the published SPL query on this page against Splunk Enterprise / Enterprise Security. It reads asset_inventory.csv (lookup), index=cloud and reports: Asset declared as requiring audit logging is producing no observed telemetry in the observation window.

NIST SP 800-53 Rev. 5 · Audit and Accountability

AU-12 on Splunk

Required audit logging not enabled — a published SPL query you can run against Splunk Enterprise / Enterprise Security, with the evidence it needs, the settings you decide, and what a result does and does not establish.

Why this matters

A system that is supposed to be recording events and is silently recording nothing

Organizations decide which systems must keep an event record, and then assume the arrangement holds. Recording breaks quietly: an agent stops running, a setting is lost during a rebuild, a new system is created without it. Nothing raises an alarm, because the absence of records looks identical to the absence of activity.

Why this check earns its place. Silence is the hardest failure to notice, because there is nothing to see. This check compares what should be reporting against what actually is, which is the only way the gap becomes visible.

What it reads: The organization's own list of systems that must keep records, compared against what is actually arriving.
What it reports: Systems declared as requiring an event record that have produced none during the period examined.

See related public disclosures on the Signals page →

ControlAU-12 — Audit Record Generation

PlatformSplunk (SPL)

SeverityHigh

ValidationLab-validated

What this finds

Asset declared as requiring audit logging is producing no observed telemetry in the observation window.

The requirement

The organization must provide audit record generation capability for the event types the system is capable of auditing, on all components that require auditing.
NIST SP 800-53 Rev. 5 — AU-12 (Audit Record Generation).

NIST requires audit generation on components that require auditing. Which components those are is an organizational decision, supplied here through the asset inventory's logging_required flag. The platform cannot infer it.

How this maps to the CISA performance goals

The Cross-Sector Cybersecurity Performance Goals are a voluntary baseline published by CISA — the U.S. federal agency for critical-infrastructure cybersecurity — written for organizations too small to employ security staff. This control speaks to:

3.Q — Maintain log collection & storage
The goal requires the relevant logs to exist; the pack finds required logging not enabled.
4.B — Identify adverse events
Adverse events cannot be identified from telemetry that was never recorded.

See the full coverage map, including the goals no query can answer →

Evidence this query needs

Asset inventory `asset_inventory.csv`

Declares which assets are in scope and what is required of them. A backup that never ran on an asset you did not know existed produces no alert — absence of evidence is invisible without an inventory to compare against.

Minimum fields: asset_id, environment, criticality

Three fields let you scope the checks. The backup_required and logging_required flags are what make the absence checks possible — without them the tool cannot tell an asset that should be backed up from one that should not.

The query

Published as au-12-logging-coverage.splunk.spl. Reads asset_inventory.csv (lookup), index=cloud. Requires: Search access to the cloud index; Read on the lookup.

Before this returns anything, index=cloud has to be reaching Splunk Enterprise / Enterprise Security, and asset_inventory.csv (lookup) has to be landed there. If not, the query reports nothing found — which looks exactly like nothing wrong. What has to be switched on first →

| inputlookup asset_inventory.csv
| where logging_required="TRUE"
| where isnull(decommission_date) OR decommission_date=""
        OR strptime(decommission_date,"%Y-%m-%d") > now()
| eval asset_key=lower(asset_id)
| join type=left asset_key
    [ search index=cloud earliest=-3d
      | eval asset_key=lower(resource_id)
      | stats count as event_count by asset_key ]
| where isnull(event_count) OR event_count=0
| eval priority=case(criticality="critical",1, criticality="high",2,
                     criticality="medium",3, 1=1,4)
| table asset_id, asset_name, environment, criticality, owner, priority
| sort priority

Open this pack on Splunk to adjust the settings and download it →

The interactive version opens on Splunk — the platform on this page — even if your environment profile does not list it.

Settings you decide

NIST states the objective and leaves these to your organization. The interactive version of this pack applies them to the query for you.

Observation window (days) (default 3): An in-scope asset producing no telemetry across this window is reported.
Limit to specific assets (optional): Paste asset identifiers, one per line.

What this query returned when it was run

Executed against Splunk Enterprise 10.4.2 on 2026-08-07 against purpose-built test data. The software examined 0 records and returned 1 result in 0.078 seconds.

asset_id	asset_name	environment	criticality	owner	priority
sql-finance-prod	Finance SQL	production	critical	DATA-ENG	1

Test data, not a real organization. It shows the query executes and returns the intended shape of result.

Running it continuously

Correlation search → notable event

Search type:      Correlation search (Enterprise Security)
Cron schedule:    0 7 * * *   (daily, 07:00)
Time range:       -3d to now
Trigger:          Number of results > 0
Alert action:     Create notable event, assign by owner field
Urgency:          High
Security domain:  Audit
Throttling:       Suppress 3d on asset_id

Assigning the notable by the inventory's owner field routes each gap to the team that can actually fix it, rather than pooling everything in one queue.

What a result does not prove

Absence of telemetry may reflect an inventory error, a routing change, or a genuinely idle asset rather than disabled logging. This check identifies where audit coverage cannot be evidenced — not where it definitively fails.

Validation status for this platform: Lab-validated. Executed by the maintainer in a personally controlled laboratory environment on the date shown. Table names, field names, and operator support still vary by tenant configuration, API version, connector, and add-on.

Before you act on a result

Is the asset genuinely in scope, or is the inventory flag wrong?
Was the asset created inside the grace period?
Is telemetry flowing to a destination this query does not read?
Has the asset been decommissioned without the inventory being updated?

Common questions

How do I check for required audit logging not enabled in Splunk?: Run the published SPL query on this page against Splunk Enterprise / Enterprise Security. It reads asset_inventory.csv (lookup), index=cloud and reports: Asset declared as requiring audit logging is producing no observed telemetry in the observation window.
What permissions are needed to run this Splunk query?: Search access to the cloud index; Read on the lookup.
What evidence does AU-12 need that Splunk cannot produce?: Asset inventory (asset_inventory.csv). Declares which assets are in scope and what is required of them. A backup that never ran on an asset you did not know existed produces no alert — absence of evidence is invisible without an inventory to compare against. At minimum it must carry: asset_id, environment, criticality.
Does a result from this query mean the control has failed?: Absence of telemetry may reflect an inventory error, a routing change, or a genuinely idle asset rather than disabled logging. This check identifies where audit coverage cannot be evidenced — not where it definitively fails.

Terms used on this page

NIST SP 800-53the U.S. federal catalogue of security requirements: The catalogue of security and privacy requirements published by the National Institute of Standards and Technology, a U.S. federal agency. U.S. government systems are measured against it, and many private organizations adopt it voluntarily. Each requirement has an identifier such as AC-2. Official source →
CISACybersecurity and Infrastructure Security Agency: The U.S. federal agency responsible for national critical-infrastructure cybersecurity. Its publications are works of the U.S. government and are free to use. Official source →
SPLSearch Processing Language: The language used to ask questions of data held in Splunk. A query written in it is text and can be read before it is run.
CPGCross-Sector Cybersecurity Performance Goals: A voluntary baseline of security practices published by the U.S. Cybersecurity and Infrastructure Security Agency, written specifically for organizations too small to employ security staff. It is a short, plainly written starting list rather than a full standard. Official source →
lab-validatedexecuted in a controlled test environment: The check has been run, by the maintainer, against real security software loaded with purpose-built test data, and what it returned was recorded. It has not been run on any real organization's data.

Every term this project uses →