How do I check for audit logging disabled or deleted in Splunk?

Run the published SPL query on this page against Splunk Enterprise / Enterprise Security. It reads index=cloud sourcetype=aws:cloudtrail or azure:activity and reports: Audit logging configuration stopped, deleted, or modified; the reviewer determines whether the actor was authorized.

NIST SP 800-53 Rev. 5 · Audit and Accountability

AU-9 on Splunk

Audit logging disabled or deleted — a published SPL query you can run against Splunk Enterprise / Enterprise Security, with the evidence it needs, the settings you decide, and what a result does and does not establish.

Why this matters

Someone switched off the recording of what happens on the system

Systems keep a record of significant events, and that record is how anyone reconstructs what happened after an incident. It is also the first thing an intruder turns off, because everything they do afterwards goes unrecorded. Switching it off is a legitimate administrative action, so it does not look like an attack — which is why it works.

Why this check earns its place. The check does not decide whether the person was allowed to do it. It surfaces that it happened, so a human can ask, which is the only correct handling for an action that is sometimes routine and sometimes the first move of a break-in.

What it reads: The organization's own record of administrative actions taken on its systems.
What it reports: Occasions when the recording of system events was stopped, deleted, or altered.

See related public disclosures on the Signals page →

ControlAU-9 — Protection of Audit Information

PlatformSplunk (SPL)

SeverityCritical

ValidationLab-validated

What this finds

Audit logging configuration stopped, deleted, or modified; the reviewer determines whether the actor was authorized.

The requirement

The organization must protect audit information and audit logging tools from unauthorized access, modification, and deletion.
NIST SP 800-53 Rev. 5 — AU-9 (Protection of Audit Information).

NIST requires protection of audit information. Which logging surfaces are in scope, which identities may legitimately modify logging configuration, and the expected response time are organization-defined.

How this maps to the CISA performance goals

The Cross-Sector Cybersecurity Performance Goals are a voluntary baseline published by CISA — the U.S. federal agency for critical-infrastructure cybersecurity — written for organizations too small to employ security staff. This control speaks to:

3.Q — Maintain log collection & storage
The goal requires logs to be collected and retained; the pack finds logging switched off or records removed.

See the full coverage map, including the goals no query can answer →

Evidence this query needs

None. This query runs on platform telemetry alone — there is no file to prepare and nothing to export.

The query

Published as au-9-audit-tampering.splunk.spl. Reads index=cloud sourcetype=aws:cloudtrail or azure:activity. Requires: Search access to the cloud index.

Before this returns anything, index=cloud sourcetype=aws:cloudtrail or azure:activity has to be reaching Splunk Enterprise / Enterprise Security. If not, the query reports nothing found — which looks exactly like nothing wrong. What has to be switched on first →

index=cloud (sourcetype=aws:cloudtrail OR sourcetype=azure:activity)
| search (eventName IN ("StopLogging","DeleteTrail","UpdateTrail",
                        "PutEventSelectors")
       OR operationName IN ("MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/DELETE",
                            "MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE"))
| eval actor=coalesce('userIdentity.arn', caller)
| eval action=coalesce(eventName, operationName)
| table _time, actor, action, sourceIPAddress,
        resource_id, source_system
| sort - _time

Open this pack on Splunk to adjust the settings and download it →

The interactive version opens on Splunk — the platform on this page — even if your environment profile does not list it.

Settings you decide

NIST states the objective and leaves these to your organization. The interactive version of this pack applies them to the query for you.

Review window (days) (default 7): How far back to examine logging-configuration changes.

What this query returned when it was run

Executed against Splunk Enterprise 10.4.2 on 2026-08-07 against purpose-built test data. The software examined 6 records and returned 2 results in 0.088 seconds.

actor	action	sourceIPAddress	resource_id	source_system
arn:aws:iam::123456789012:user/ops-admin	StopLogging	203.0.113.42	trail-prod-audit	AWS CloudTrail
[email protected]	MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/DELETE	203.0.113.51	stprodeastus01	Azure Activity

Test data, not a real organization. It shows the query executes and returns the intended shape of result.

Running it continuously

Real-time correlation search → notable event

Search type:      Real-time correlation search
Schedule:         Real-time (or 1-minute cron for lower cost)
Trigger:          Any result
Alert action:     Create notable event + PagerDuty
Urgency:          Critical
Security domain:  Audit
Drill-down:       index=cloud actor="$actor$" earliest=-24h
Throttling:       None

Real-time searches carry ongoing cost in Splunk. A 1-minute scheduled search is a reasonable compromise for most environments and detects tampering nearly as fast.

What a result does not prove

A logging configuration change is not automatically malicious. It is, however, one of the few conditions where the cost of a slow review is high enough to justify treating it as urgent by default.

Validation status for this platform: Lab-validated. Executed by the maintainer in a personally controlled laboratory environment on the date shown. Table names, field names, and operator support still vary by tenant configuration, API version, connector, and add-on.

Before you act on a result

Was this part of an approved change or platform migration?
Is the actor an automation identity that should be allowlisted?
Was logging restored, and was there a gap in coverage?
Does other activity by the same actor in the surrounding window warrant investigation?

Common questions

How do I check for audit logging disabled or deleted in Splunk?: Run the published SPL query on this page against Splunk Enterprise / Enterprise Security. It reads index=cloud sourcetype=aws:cloudtrail or azure:activity and reports: Audit logging configuration stopped, deleted, or modified; the reviewer determines whether the actor was authorized.
What permissions are needed to run this Splunk query?: Search access to the cloud index.
Does a result from this query mean the control has failed?: A logging configuration change is not automatically malicious. It is, however, one of the few conditions where the cost of a slow review is high enough to justify treating it as urgent by default.

Terms used on this page

NIST SP 800-53the U.S. federal catalogue of security requirements: The catalogue of security and privacy requirements published by the National Institute of Standards and Technology, a U.S. federal agency. U.S. government systems are measured against it, and many private organizations adopt it voluntarily. Each requirement has an identifier such as AC-2. Official source →
CISACybersecurity and Infrastructure Security Agency: The U.S. federal agency responsible for national critical-infrastructure cybersecurity. Its publications are works of the U.S. government and are free to use. Official source →
SPLSearch Processing Language: The language used to ask questions of data held in Splunk. A query written in it is text and can be read before it is run.
CPGCross-Sector Cybersecurity Performance Goals: A voluntary baseline of security practices published by the U.S. Cybersecurity and Infrastructure Security Agency, written specifically for organizations too small to employ security staff. It is a short, plainly written starting list rather than a full standard. Official source →
lab-validatedexecuted in a controlled test environment: The check has been run, by the maintainer, against real security software loaded with purpose-built test data, and what it returned was recorded. It has not been run on any real organization's data.

Every term this project uses →