Detect · Established tier · Security Operations

DE-04Daily log review is performed and recorded

Security logs are reviewed every day, and each review is signed off so it can be shown to an assessor.

Status

Partial evidence

1 item only partly supports it.

Exposure

Medium

1 evidence items from 1 sources

CCSA · Detect

Foundational

This control blocks Established for the whole domain.

What the evidence shows

Daily review happens, but sign-off is recorded on only 19 of 30 days.

Remediation · Security Operations

Make the review sign-off a required step in the SOC shift handover.

Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.

ev-de04-1

Review sign-off recorded on 19 of 30 days (62%)

Splunk Enterprise · telemetry · collected 4 h ago (Oct 15, 2026 · 11:02 UTC) · limit 30 days

Partial

Query: index=_audit action=search savedsearch_name="Daily review*" | stats dc(date_mday)
Identity: token svc-assurance (role assurance_ro, named indexes)
Collector: splunk-collector 3.0.1
Window: 720 h
Records: 30
SHA-256: 2ff46d33b7a72262f44671049161d564b2089ea61d16ea4ce755fd9dc43134d3