Recognises logs the recorded people can alter
Logs writable by the administrators they record.
Can AI do this?
AI does this well Most of the tested AI models master this. 4 of 4 models in the current benchmark master it.
| Model | Tier | Probability of mastery | Status |
|---|---|---|---|
| gemini-4-argon | Flagship | 98% | Mastered |
| gemini-3.5-flash-lite | Low cost | 98% | Mastered |
| gpt-6-luna | Low cost | 97% | Mastered |
| claude-haiku-5-5 | Low cost | 98% | Mastered |
Mastered means a probability of at least 90% that the model has this knobit, estimated from its graded answers. “Not shown” means the answers do not settle it either way. How the models are tested.
What it looks like in practice
Expected result: The log and a store its subjects cannot change
How it is assessed: Flags the deficient case and passes the acceptable one. Deficient: LS-001 DBA audit table in the same database, DBAs have write Acceptable: Shipped to a SIEM the DBAs cannot change
Also known as: Logs the recorded people can alter
Related knobits
Builds on
- S-551 Explains logging and monitoring of data access
- C-552 Explains the audit trail of a records repository
Usually followed by
All 16 knobits of Monitor and audit access.
Source: Review checklist 05-monitoring-audit, row 5 (27002 8.15; PCI 10.3.2)