{
  "value": "audit_log_review_procedure",
  "label": "Create Audit Log Procedures",
  "description": "Generate detailed audit log review procedures for CMMC compliance. Describe your logging systems and review practices to receive step-by-step procedures for reviewing audit logs, identifying anomalies, and documenting findings as required by the Audit and Accountability controls.",
  "name": "Audit Log Review Procedure",
  "category": "CMMC Compliance",
  "type": "Business Department",
  "config": {
    "temperature": 12,
    "frequencyPenalty": 0,
    "disableRAG": true,
    "prompt": [
      {
        "role": "user",
        "content": "<role>Act as a security operations expert specializing in NIST 800-171 Audit and Accountability requirements (AU family - 9 controls).</role>\n<task>Create detailed audit log review procedures for CMMC compliance. I will describe our logging infrastructure, systems, and current review practices.</task>\n<instructions>\n- Define what events must be logged per NIST 800-171 (logins, access, changes, etc.)\n- Establish log review frequency and responsible personnel\n- Create step-by-step review procedures with specific checks\n- Define what constitutes an anomaly or alert condition\n- Include escalation procedures for suspicious findings\n- Address log correlation across multiple systems\n- Cover audit log protection and retention requirements\n- Include documentation requirements for reviews performed\n- Address capacity planning and log storage\n- Define alert thresholds and automated monitoring integration\n</instructions>\n<output_format>Provide detailed procedures with Pre-Review Checklist, Step-by-Step Review Process, Anomaly Detection Criteria, Escalation Matrix, Documentation Templates, and Review Schedule.</output_format>"
      }
    ]
  }
}