[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F8":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","8","Control 8","Audit Log Management",740,"Center for Internet Security (CIS)","**What it asks for.** This control expects organisations to collect, review and retain audit logs that can help detect, understand and recover from an attack. It covers deciding what to log, keeping time synchronised, storing logs centrally and retaining them long enough.\n\n**In practice.** There is a logging standard that names required sources and event types, such as authentication, privilege use, DNS and command line activity, with logs forwarded to a central platform protected from tampering. Clocks are synchronised, retention meets both investigation and legal needs, and logs are actually reviewed through alerting and periodic analysis. Evidence includes the logging standard, source coverage lists, retention settings and records of reviews.\n\n**Common gaps.** Logs are frequently collected but never reviewed, or key sources such as cloud control planes and SaaS audit logs are missing. Retention is often too short to support investigations of intrusions discovered months later.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Faudit-log-management","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},778,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"ransomware-groups-weaponize-legitimate-vmware-tools-to-destroy-backups-before-encrypting","Ransomware Groups Weaponize Legitimate VMware Tools to Destroy Backups Before Encrypting","2026-11-13T11:22:12.372+00:00",{"slug":24,"title":25,"published_at":26},"fatf-exposes-100m-crypto-laundering-trail-behind-global-scam-networks","FATF Exposes $100M Crypto Laundering Trail Behind Global Scam Networks","2026-11-12T13:20:40.019+00:00",{"slug":28,"title":29,"published_at":30},"bot-impersonation-of-ai-agents-bypasses-mfa-and-floods-sign-in-pages","Bot Impersonation of AI Agents Bypasses MFA and Floods Sign-In Pages","2026-11-12T06:20:57.915+00:00",{"slug":32,"title":33,"published_at":34},"fbi-agent-embezzles-25m-in-crypto-using-privileged-case-system-access","FBI Agent Embezzles $2.5M in Crypto Using Privileged Case System Access","2026-11-09T15:21:03.792+00:00",{"slug":36,"title":37,"published_at":38},"ai-agent-sandbox-escape-exposes-customer-records-via-unsecured-internal-tool","AI Agent Sandbox Escape Exposes Customer Records via Unsecured Internal Tool","2026-11-07T03:20:21.478+00:00",{"slug":40,"title":41,"published_at":42},"fbi-agent-steals-24m-in-crypto-by-abusing-privileged-system-access","FBI Agent Steals $2.4M in Crypto by Abusing Privileged System Access","2026-11-06T18:21:02.811+00:00",{"slug":44,"title":45,"published_at":46},"linux-backdoor-in-cwp-server-evades-logs-via-root-access-abuse","Linux Backdoor in CWP Server Evades Logs via Root Access Abuse","2026-11-06T08:20:46.311+00:00",{"slug":48,"title":49,"published_at":50},"ai-model-covertly-sabotaged-safety-research-exposing-ai-oversight-gaps","AI Model Covertly Sabotaged Safety Research, Exposing AI Oversight Gaps","2026-11-05T20:20:27.913+00:00",{"slug":52,"title":53,"published_at":54},"trojanized-cwp-web-server-delivers-stealthy-linux-backdoor-to-340000-exposed-hosts","Trojanized CWP Web Server Delivers Stealthy Linux Backdoor to 340,000+ Exposed Hosts","2026-11-05T17:20:49.602+00:00",{"slug":56,"title":57,"published_at":58},"ai-agents-create-new-data-exfiltration-risks-without-proper-oversight","AI Agents Create New Data Exfiltration Risks Without Proper Oversight","2026-11-05T16:20:25.057+00:00",{"slug":60,"title":61,"published_at":62},"ai-agents-operate-in-the-shadows-as-self-identification-drops-below-3","AI Agents Operate in the Shadows as Self-Identification Drops Below 3%","2026-11-05T15:21:29.406+00:00",{"slug":64,"title":65,"published_at":66},"ai-jailbreak-toolkit-hides-prompt-adware-in-codex-agent-responses","AI Jailbreak Toolkit Hides Prompt Adware in Codex Agent Responses","2026-11-04T18:22:13.955+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",316,{"slug":74,"name":75,"problem":76,"stories":77},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",178,{"slug":79,"name":80,"problem":81,"stories":82},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",163,{"slug":84,"name":85,"problem":86,"stories":87},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",107,{"slug":89,"name":90,"problem":91,"stories":92},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",102,{"slug":94,"name":95,"problem":96,"stories":97},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",85,[99,104,110,116,121,126,131,136],{"family":5,"item":100,"code":101,"title":102,"together":103},"6","Control 6","Access Control Management",370,{"family":105,"item":106,"code":107,"title":108,"together":109},"nist-800-53","ac-2","AC-2","Account Management",292,{"family":111,"item":112,"code":113,"title":114,"together":115},"gdpr","32","Article 32","Security of processing",280,{"family":105,"item":117,"code":118,"title":119,"together":120},"ac-6","AC-6","Least Privilege",237,{"family":122,"item":123,"code":124,"title":124,"together":125},"itil","overview","ITIL",227,{"family":5,"item":127,"code":128,"title":129,"together":130},"3","Control 3","Data Protection",193,{"family":105,"item":132,"code":133,"title":134,"together":135},"si-4","SI-4","System Monitoring",189,{"family":5,"item":137,"code":138,"title":108,"together":139},"5","Control 5",185]