Title

The container platform must generate audit records containing the full-text recording of privileged commands or the individual identities of group account users. (Cat II impact)

Discussion

During an investigation of an incident, it is important to fully understand what took place. Often, information is not part of the audited event due to the data's nature, security risk, or audit log size. Organizations must consider limiting the additional audit information to only that information explicitly needed for specific audit requirements. At a minimum, the organization must audit either full-text recording of privileged commands, or the individual identities of group users, or both.

Check Content

Review the documentation and deployment configuration to determine if the container platform is configured to generate full-text recording of privileged commands or the individual identities of group users at a minimum. Have a user execute a privileged command and review the log data to validate that the full-text or identity of the individual is being logged. If the container platform is not meeting this requirement, this is a finding.

Fix Text

Configure the container platform to generate the full-text recording of privileged commands, or the individual identities of group users, or both.

Additional Identifiers

Rule ID: SV-233049r879569_rule

Vulnerability ID: V-233049

Group Title: SRG-APP-000101

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.