settings for event
163602·updated Sep 1, 2026A configuration parameter set — part of an audit policy — that specifies which categories or subcategories of system and security activity a platform will record in its logs, along with whether successes, failures, or both trigger a log entry. It is distinguished from the log itself or the review of logs: it is the upstream, declarative control that gates what evidence gets generated in the first place. Standards bodies and platform vendors treat it as the mechanism by which organizations "track precisely defined activities," selecting "only the behaviors that you want to monitor" — making it a foundational element of audit-and-accountability control families such as NIST 800-53 AU-2 (Audit Events) and CIS guidance to "configure detailed audit logging" including event source, date, username, timestamp, and addresses that would support forensic investigation.
Source
, configuring settings for events to be audited, establishingthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: compositional.
- Advanced security audit policy settings - Windows 10 | Microsoft Learn
- Office 365 Security Best Practices for CIS & NIST Compliance
- CIS Controls Navigator v8.1
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A policy-level configuration artifact that specifies which system or application activities will be captured in audit logs, along with the parameters governing how each activity is recorded (e.g., success, failure, or both). It is the administrative mechanism by which an organization operationalizes its audit policy — translating requirements from frameworks such as NIST SP 800-53 AU-2, CIS Control 8, and ISO 27001 into discrete, enforceable controls that determine what the logging subsystem actually monitors. In practice, practitioners configure these settings to balance security visibility against system performance and log noise, selecting from available event categories and subcategories to meet compliance obligations and support incident investigation.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- settings for events
- possessive
- settings for event's
- pluralpossessive
- settings for events'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A configuration parameter set — part of an audit policy — that specifies which categories or subcategories of system and security activity a platform will record in its logs, along with whether successes, failures, or both trigger a log entry. It is distinguished from the log itself or the review of logs: it is the upstream, declarative control that gates what evidence gets generated in the first place. Standards bodies and platform vendors treat it as the mechanism by which organizations "track precisely defined activities," selecting "only the behaviors that you want to monitor" — making it a foundational element of audit-and-accountability control families such as NIST 800-53 AU-2 (Audit Events) and CIS guidance to "configure detailed audit logging" including event source, date, username, timestamp, and addresses that would support forensic investigation.DR-088 backfill from the noun definition column