EIDTNT-012: Audit Log Retention Settings
- Plataforma
- Entra ID / M365
- Categoría
- Entra ID Tenant Configuration
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 2)
- Fixtures de referencia
- 1
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Audit log retention determines how long historical security events are available for investigation, compliance reporting, and forensic analysis. Insufficient retention periods may result in critical evidence being unavailable when investigating incidents that are discovered weeks or months after the initial compromise. Organizations should retain audit logs for at least 1 year to support incident response timelines and meet common regulatory requirements.
Valor recomendado
Audit logs retained for a minimum of 1 year in an immutable storage location with at least 90 days immediately queryable
Remediación
Review the retention settings on the Log Analytics workspace, Azure Storage account, or SIEM destination where Entra ID logs are exported. Configure retention for at least 365 days for all Entra ID log categories to support incident investigation and compliance requirements. Ensure that at least 90 days of logs are immediately queryable without restore operations, and implement immutable storage or write-once policies to prevent tampering with historical log data.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| always-warn | WARN |
Mapeos a marcos de referencia
- CISA SCuBA
- MS.AAD.4.1v1
- NIST SP 800-53
- AU-11
- CIS M365 Benchmark
- 3.1