V-233049

Discussion

During an investigation of an incident, it is important to fully understand what took place. Often, information is not part of the audited event due to the data's nature, security risk, or audit log size. Organizations must consider limiting the additional audit information to only that information explicitly needed for specific audit requirements. At a minimum, the organization must audit either full-text recording of privileged commands, or the individual identities of group users, or both.

Check Content

Review the documentation and deployment configuration to determine if the container platform is configured to generate full-text recording of privileged commands or the individual identities of group users at a minimum. 

Have a user execute a privileged command and review the log data to validate that the full-text or identity of the individual is being logged. 

If the container platform is not meeting this requirement, this is a finding.