Title

The container platform components must provide the ability to send audit logs to a central enterprise repository for review and analysis. (Cat II impact)

Discussion

The container platform components must send audit events to a central managed audit log repository to provide reporting, analysis, and alert notification. Incident response relies on successful timely, accurate system analysis in order for the organization to identify and respond to possible security events.

Check Content

Review the configuration settings to determine if the container platform components are configured to send audit events to central managed audit log repository. If the container platform is not configured to send audit events to central managed audit log repository, this is a finding.

Fix Text

Configure the container platform components to send audit logs to a central managed audit log repository.

Additional Identifiers

Rule ID: SV-233052r879572_rule

Vulnerability ID: V-233052

Group Title: SRG-APP-000111

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.