settings for event
A configuration parameter set — part of an audit policy — that specifies which categories or subcategories of system and security activity a platform will record in its logs, along with whether successes, failures, or both trigger a log entry. It is distinguished from the log itself or the review of logs: it is the upstream, declarative control that gates what evidence gets generated in the first place. Standards bodies and platform vendors treat it as the mechanism by which organizations "track precisely defined activities," selecting "only the behaviors that you want to monitor" — making it a foundational element of audit-and-accountability control families such as NIST 800-53 AU-2 (Audit Events) and CIS guidance to "configure detailed audit logging" including event source, date, username, timestamp, and addresses that would support forensic investigation.
Framework senses
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A configuration parameter set — part of an audit policy — that specifies which categories or subcategories of system and security activity a platform will record in its logs, along with whether successes, failures, or both trigger a log entry. It is distinguished from the log itself or the review of logs: it is the upstream, declarative control that gates what evidence gets generated in the first place. Standards bodies and platform vendors treat it as the mechanism by which organizations "track precisely defined activities," selecting "only the behaviors that you want to monitor" — making it a foundational element of audit-and-accountability control families such as NIST 800-53 AU-2 (Audit Events) and CIS guidance to "configure detailed audit logging" including event source, date, username, timestamp, and addresses that would support forensic investigation.DR-088 backfill from the noun definition column