Title

The UEM server must be configured to produce audit records containing information to establish where the events occurred. (Cat II impact)

Discussion

Failure to generate these audit records makes it more difficult to identify or investigate attempted or successful compromises, potentially causing incidents to last longer than necessary.

Check Content

Verify the UEM server produces audit records containing information to establish where the events occurred. If the UEM server does not produce audit records containing information to establish where the events occurred, this is a finding.

Fix Text

Configure the UEM server to be configured to produce audit records containing information to establish where the events occurred.

Additional Identifiers

Rule ID: SRG-APP-000097-UEM-000057_rule

Vulnerability ID: SRG-APP-000097-UEM-000057

Group Title: SRG-APP-000097-UEM-000057

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.