Check: AZLX-23-001025
Amazon Linux 2023 STIG:
AZLX-23-001025
(in version v1 r1)
Title
Amazon Linux 2023 must have the audit package installed. (Cat II impact)
Discussion
Successful incident response and auditing relies on timely, accurate system information and analysis to allow the organization to identify and respond to potential incidents in a proficient manner. If Amazon Linux 2023 does not provide the ability to centrally review Amazon Linux 2023 logs, forensic analysis is negatively impacted. Segregation of logging data to multiple disparate computer systems is counterproductive and makes log analysis and log event alarming difficult to implement and manage, particularly when the system has multiple logging components writing to different locations or systems. To support the centralized capability, Amazon Linux 2023 must be able to provide the information in a format that can be extracted and used, allowing the application performing the centralization of the log records to meet this requirement. Satisfies: SRG-OS-000062-GPOS-00031, SRG-OS-000042-GPOS-00021, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000055-GPOS-00026
Check Content
Verify Amazon Linux 2023 has the audit package installed with the following command: $ dnf list --installed audit Installed Packages audit.x86_64 3.0.6-1.amzn2023.0.2 @System If the "audit" package is not installed, this is a finding.
Fix Text
Configure Amazon Linux 2023 so that the audit service to produce audit records containing the information needed to establish when (date and time) an event occurred. Install the audit service (if the audit service is not already installed) with the following command: $ sudo dnf install -y audit
Additional Identifiers
Rule ID: SV-274017r1120039_rule
Vulnerability ID: V-274017
Group Title: SRG-OS-000062-GPOS-00031
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000130 |
Ensure that audit records contain information that establishes what type of event occurred. |
| CCI-000131 |
Ensure that audit records containing information that establishes when the event occurred. |
| CCI-000132 |
Ensure that audit records containing information that establishes where the event occurred. |
| CCI-000133 |
Ensure that audit records containing information that establishes the source of the event. |
| CCI-000134 |
Ensure that audit records containing information that establishes the outcome of the event. |
| CCI-000135 |
Generate audit records containing the organization-defined additional information that is to be included in the audit records. |
| CCI-000154 |
Provide the capability to centrally review and analyze audit records from multiple components within the system. |
| CCI-000158 |
Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records. |
| CCI-000159 |
Use internal system clocks to generate time stamps for audit records. |
| CCI-000169 |
Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a on organization-defined information system components. |
| CCI-000172 |
Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3. |
| CCI-001464 |
Initiates session audits automatically at system start-up. |
| CCI-001487 |
Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event. |
| CCI-001875 |
Provide an audit reduction capability that supports on-demand audit review and analysis. |
| CCI-001876 |
Provide an audit reduction capability that supports on-demand reporting requirements. |
| CCI-001877 |
Provide an audit reduction capability that supports after-the-fact investigations of incidents. |
| CCI-001878 |
Provide a report generation capability that supports on-demand audit review and analysis. |
| CCI-001879 |
Provide a report generation capability that supports on-demand reporting requirements. |
| CCI-001880 |
Provide a report generation capability that supports after-the-fact investigations of security incidents. |
| CCI-001881 |
Provide an audit reduction capability that does not alter original content or time ordering of audit records. |
| CCI-001882 |
Provide a report generation capability that does not alter original content or time ordering of audit records. |
| CCI-001889 |
Record time stamps for audit records that meet organization-defined granularity of time measurement. |
| CCI-001914 |
Provide the capability for organization-defined individuals or roles to change the logging to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds. |
| CCI-002884 |
Log organization-defined audit events for nonlocal maintenance and diagnostic sessions. |
| CCI-003938 |
Automatically generate audit records of the enforcement actions. |
Controls
| Number | Title |
|---|---|
| AU-3 |
Content of Audit Records |
| AU-3(1) |
Additional Audit Information |
| AU-6(4) |
Central Review and Analysis |
| AU-7 |
Audit Record Reduction and Report Generation |
| AU-7(1) |
Automatic Processing |
| AU-8 |
Time Stamps |
| AU-12 |
Audit Record Generation |
| AU-12(3) |
Changes by Authorized Individuals |
| AU-14(1) |
System Start-up |
| CM-5(1) |
Automated Access Enforcement and Audit Records |
| MA-4(1) |
Logging and Review |