Not every log message has the same security or compliance value.

Trestle works with agencies to identify and collect security-relevant events from supported systems, including activity such as:

• Successful and failed authentication

• Administrative logins

• Privileged-account activity

• Account creation, deletion and modification

• Group and privilege changes

• Password-related events

• Access-control activity

• Security policy changes

• Firewall and VPN activity

• Configuration changes

• Audit-system activity

• Attempts to access or modify audit information

• Security-device detections

• System and service events

CJIS AU-2 specifically requires agencies to determine appropriate event types and includes required categories of auditable activity. Law Enforcement

inSight Logging helps establish the technical foundation necessary to collect and retain that evidence.

CJIS alignment: AU-2, AU-3, AU-12, AC-2, AC-6

Local device logs frequently have limited storage. High event volumes, device reboots, storage exhaustion or log rotation can eliminate historical information long before it is needed.

inSight Logging moves supported records into centralized storage designed for longer-term retention.

Standard service can include:

• 366-day baseline log retention

• Centralized US-based storage

• Defined retention periods

• Historical event retrieval

• Source-specific retention tracking

• Capacity monitoring

• Extended retention options where required

CJIS AU-11 requires audit records to be retained for at least one year, and longer when records remain necessary for administrative, legal, audit or other operational purposes. Law Enforcement

366-day baseline retention is intentionally aligned with that minimum requirement.

CJIS alignment: AU-4, AU-11

Audit information loses much of its value if the activity being audited can also erase the evidence.

Centralized logging helps separate historical audit records from the systems and devices that originally generated them.

inSight Logging is designed to reduce dependence on locally stored records and support controls surrounding:

• Centralized log storage

• Restricted administrative access

• Protection against unauthorized alteration

• Protection against unauthorized deletion

• Separation of audit evidence from source systems

• Historical evidence preservation

CJIS specifically addresses protection of audit information under AU-9 and limits management of audit-logging functionality to appropriate authorized personnel. Law Enforcement

Centralizing audit information can therefore provide both operational and compliance value:

An administrator—or attacker—compromising a monitored device should not automatically control the historical evidence stored about that device.

CJIS alignment: AU-9, AC-5, AC-6

A logging system provides little compliance value if logs quietly stop arriving.

Trestle can monitor supported logging infrastructure for conditions that affect the integrity and availability of audit evidence, including:

• Log-source communication failures

• Unexpected interruption of event collection

• Logging infrastructure availability

• Storage utilization

• Collection-service health

• Abnormal changes in event volume

• Other conditions indicating loss of audit visibility

This is particularly important to CJIS AU-5 — Response to Audit Logging Process Failures, which addresses failures including hardware/software errors, failures of audit-capture mechanisms and audit-storage capacity conditions. Law Enforcement

The objective isn't merely:

"Is the server running?"

It is:

"Are we still receiving the audit evidence we're relying upon?"

CJIS alignment: AU-4, AU-5, AU-12

A useful audit trail must establish when activity occurred.

Accurate and consistent timestamps become particularly important when correlating events across firewalls, domain controllers, endpoints, servers and other infrastructure during an investigation.

inSight Logging helps preserve event information necessary to reconstruct activity across multiple systems and supports agency efforts to maintain consistent time sources throughout monitored infrastructure.

This improves:

• Incident timelines

• Authentication investigations

• Administrative-activity review

• Cross-system event correlation

• Audit evidence

• Forensic reconstruction

CJIS alignment: AU-3, AU-8

Collecting hundreds of millions of events provides little value if relevant information cannot be retrieved.

inSight Logging provides centralized access to retained audit records so Trestle can assist agencies in locating historical activity associated with:

• User accounts

• IP addresses

• Systems and devices

• Authentication attempts

• Administrative activity

• Configuration changes

• Security incidents

• Specific time periods

• Other supported event attributes

This can dramatically reduce the effort required to answer questions such as:

Who logged into this system?

Was an administrator logged in when this configuration changed?

Were there failed authentication attempts before the successful login?

What was the firewall doing when this incident occurred?

Do we still have the records from this date?

CJIS alignment: AU-6, AU-7, AU-11