@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix edu: <https://knobit.org/def/> .
@prefix knobit: <https://knobit.org/id/knobit/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix register: <https://knobit.org/id/register/> .
@prefix schema: <https://schema.org/> .
@prefix skos: <http://www.w3.org/2004/02/skos/core#> .

knobit:S-505 a edu:Knobit ;
    rdfs:label "Recognises an audit trail administrators can edit"@en,
        "Recognises logs the recorded people can alter"@en ;
    dcterms:identifier "C-503",
        "S-505" ;
    dcterms:license <https://creativecommons.org/licenses/by/4.0/> ;
    dcterms:source "Review checklist 05-monitoring-audit, row 5 (27002 8.15; PCI 10.3.2)"@en,
        "Review checklist 05-repository-audit-trail, row 3 (27002 8.15; MoReq)"@en ;
    owl:sameAs <https://bitbucket.org/reffa/ontology/id/knobit/data-security/05-monitoring-audit/05> ;
    skos:altLabel "Audit trail an administrator can edit"@en,
        "Logs the recorded people can alter"@en ;
    skos:definition "Logs writable by the administrators they record."@en,
        "The trail is writable by admins."@en ;
    skos:prefLabel "Recognises an audit trail administrators can edit"@en,
        "Recognises logs the recorded people can alter"@en ;
    edu:actionVerb "Recognises"@en ;
    edu:appliesKnowledge knobit:C-552,
        knobit:S-551 ;
    edu:assessmentCriterion "Flags the deficient case and passes the acceptable one. Deficient: LS-001 DBA audit table in the same database, DBAs have write Acceptable: Shipped to a SIEM the DBAs cannot change"@en,
        "Flags the deficient case and passes the acceptable one. Deficient: RP-002 audit table editable by DMS administrators Acceptable: Append-only store outside admin control"@en ;
    edu:assessmentMethod "Review of the stage 5 eval project (reffa/skills, document-content-management/evals)"@en,
        "skill-tests task: Cardholder data environment logging and access review (dsec-monitoring-audit)"@en ;
    edu:conformsToProfile <https://oppekava.edu.ee/a/Knobitite_kirjeldamise_ja_seostamise_reeglid#LCG-KNOBIT-0.1> ;
    edu:contextFunction <https://knobit.org/def/contextFunction/resultEvaluation> ;
    edu:creationMethod <https://knobit.org/def/creationMethod/aiGenerated>,
        <https://knobit.org/def/creationMethod/aiGeneratedAiEdited> ;
    edu:expectedResult "A protected trail"@en,
        "The log and a store its subjects cannot change"@en ;
    edu:followedBy knobit:S-531 ;
    edu:graphRelevance <https://knobit.org/def/graphRelevance/learnerState>,
        <https://knobit.org/def/graphRelevance/taskSelection> ;
    edu:knobitType <https://knobit.org/def/knobitType/skill> ;
    edu:targetObject "audit log writable by the administrators it records"@en,
        "audit trail writable by administrators"@en ;
    schema:creativeWorkStatus "accepted" ;
    schema:isPartOf register:data-security,
        register:document-content-management .

edu:Knobit rdfs:label "Knobit"@en,
        "Knobit"@et .

knobit:C-552 rdfs:label "Explains the audit trail of a records repository"@en .

knobit:S-531 rdfs:label "Separates log integrity from the people logged"@en .

knobit:S-551 rdfs:label "Explains logging and monitoring of data access"@en .