Explains logging and monitoring of data access
Who, what, when, from where and the result for every privileged action and restricted read; protected logs; reviewed; rules with thresholds and responders (ISO/IEC 27002:2022 8.15, 8.16; PCI DSS v4.0.1 Req. 10; DORA Art. 10).
Can AI do this?
AI does this well Most of the tested AI models master this. 4 of 4 models in the current benchmark master it.
| Model | Tier | Probability of mastery | Status |
|---|---|---|---|
| gemini-4-argon | Flagship | 100% | Mastered |
| gemini-3.5-flash-lite | Low cost | 100% | Mastered |
| gpt-6-luna | Low cost | 100% | Mastered |
| claude-haiku-5-5 | Low cost | 100% | Mastered |
Mastered means a probability of at least 90% that the model has this knobit, estimated from its graded answers. “Not shown” means the answers do not settle it either way. How the models are tested.
What it looks like in practice
Expected result: Who, what, when, from where and the result for every privileged action and restricted read; protected logs; reviewed; rules with thresholds and responders (ISO/IEC 27002:2022 8.15, 8.16; PCI DSS v4.0.1 Req. 10; DORA Art. 10).
How it is assessed: Answers a written question on the logging and monitoring correctly
Related knobits
Needed for
- S-501 Recognises privileged access not logged
- S-503 Recognises a log nobody reviews
- S-505 Recognises logs the recorded people can alter
- S-506 Recognises a monitoring rule with no threshold or response
- S-509 Recognises restricted reads not logged
- S-531 Separates log integrity from the people logged
All 16 knobits of Monitor and audit access.
Source: Practice the stage 5 reference and review checklist rest on