Check: SRG-OS-000254-VMM-000880
Virtual Machine Manager SRG:
SRG-OS-000254-VMM-000880
(in versions v2 r2 through v1 r3)
Title
The VMM must initiate session audits at system startup. (Cat II impact)
Discussion
If auditing is enabled late in the startup process, the actions of some start-up processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created.
Check Content
Verify the VMM initiates session audits at system startup. If it does not, this is a finding.
Fix Text
Configure the VMM to initiate session audits at system startup.
Additional Identifiers
Rule ID: SV-207419r958606_rule
Vulnerability ID: V-207419
Group Title: SRG-OS-000254
Expert Comments
Expert comments are only available to logged-in users.
CCIs
CCIs tied to check.
| Number | Definition |
|---|---|
| CCI-001464 |
Initiates session audits automatically at system start-up. |
Controls
Controls tied to check. These are derived from the CCIs shown above.
| Number | Title |
|---|---|
| AU-14(1) |
System Start-up |