The HYCU virtual appliance must generate log records for a locally developed list of auditable events.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-268244 | HYCU-ND-000280 | SV-268244r1038775_rule | Medium |
| Description |
| Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the network device (e.g., module or policy filter). |
| STIG | Date |
| HYCU Protege Security Technical Implementation Guide | 2024-10-29 |
Details
| Check Text (C-72265r1038773_chk) |
| Log in to the HYCU VM console. Review the /etc/audit/auditd.conf file and verify the settings are in accordance with a locally developed list of auditable events. If it is not configured in accordance with organizational policies, this is a finding. Check for the value of the "max_log_file_action" option in "/etc/audit/auditd.conf" with the following command: sudo grep max_log_file_action /etc/audit/auditd.conf If the "max_log_file_action" value is not set to "ROTATION", this is a finding. |
| Fix Text (F-72168r1038774_fix) |
| Configure the operating system to use a locally developed list of auditable events by editing "/etc/audit/auditd.conf" files using the following command: sudo vi /etc/audit/auditd.conf Add or modify lines to have the required values for the organization. |