FAU_SAR.3 Selectable audit review
User application notes
This component is used to specify that it should be possible to perform selection of the audit data to be reviewed. If based on multiple criteria, those criteria should be related together with logical (i.e. `and' or `or') relations, and the tools should provide the ability to manipulate audit data (e.g. sort, filter).
Operations
Selection:
For FAU_SAR.3.1 the PP/ST author should select whether searches, sorting and/or ordering can be performed by the TSF.
Assignment:
For FAU_SAR.3.1, the PP/ST author should assign the criteria, possibly with logical relations, to be used to select the audit data for review. The logical relations are intended to specify whether the operation can be on an individual attribute or a collection of attributes. An example of this assignment could be: "application, user account and/or location". In this case the operation could be specified using any combination of the three attributes: application, user account and location.