Logging Requirement CTO 24-003

[Aghansah]

Is there anyone familiar with any guidance on fulfilling the logging requirements for CTO 24-003 with splunk queries and dashboard

[richgalloway]

Tell us what the requirements are and we may be able to tell you how to comply with them.

[Aghansah]

DNS Server Access	Client IP, Server IP, Query Data, Query Type, Query Bytes, Reponse Type, Response Data, Response Bytes, Timestamp
Routers & Switches	Firewall IDS Logs, Firewall Rules, Router OS Logs, Routing Tables, NAT Logging
VPN Service	Remote Access + VPN Logging
Network Traffic Metadata	Netflow
Network Traffic Content	Zeek
IDS/IPS alerts, rules, events
Access Control/Access Management	TACACS | RADIUS | PKE
Access Control/Access Management Accounting	TACACS | RADIUS | PKE Accounting Logs