Title

The container runtime must generate audit records for all container execution, shutdown, restart events, and program initiations. (Cat II impact)

Discussion

The container runtime must generate audit records that are specific to the security and mission needs of the organization. Without audit record, it would be difficult to establish, correlate, and investigate events relating to an incident.

Check Content

Review the container runtime configuration to validate audit record generation for container execution, shutdown, and restart events. If the container runtime does not generate records for container execution, shutdown and restart events, this is a finding.

Fix Text

Configure the container runtime to generate audit records for container execution, shutdown, and restart events.

Additional Identifiers

Rule ID: SV-233270r879881_rule

Vulnerability ID: V-233270

Group Title: SRG-APP-000510

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.