Check: HYCU-ND-000280
HYCU Protege STIG:
HYCU-ND-000280
(in version v1 r1)
Title
The HYCU virtual appliance must generate log records for a locally developed list of auditable events. (Cat II impact)
Discussion
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the network device (e.g., module or policy filter).
Check Content
Log in to the HYCU VM console. Review the /etc/audit/auditd.conf file and verify the settings are in accordance with a locally developed list of auditable events. If it is not configured in accordance with organizational policies, this is a finding. Check for the value of the "max_log_file_action" option in "/etc/audit/auditd.conf" with the following command: sudo grep max_log_file_action /etc/audit/auditd.conf If the "max_log_file_action" value is not set to "ROTATION", this is a finding.
Fix Text
Configure the operating system to use a locally developed list of auditable events by editing "/etc/audit/auditd.conf" files using the following command: sudo vi /etc/audit/auditd.conf Add or modify lines to have the required values for the organization.
Additional Identifiers
Rule ID: SV-268244r1038775_rule
Vulnerability ID: V-268244
Group Title: SRG-APP-000516-NDM-000334
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000169 |
Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a on organization-defined information system components. |
| CCI-000366 |
Implement the security configuration settings. |