Rule ID
SV-268244r1038775_rule
Version
V1R2
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the network device (e.g., module or policy filter).
Log in to the HYCU VM console. Review the /etc/audit/auditd.conf file and verify the settings are in accordance with a locally developed list of auditable events. If it is not configured in accordance with organizational policies, this is a finding. Check for the value of the "max_log_file_action" option in "/etc/audit/auditd.conf" with the following command: sudo grep max_log_file_action /etc/audit/auditd.conf If the "max_log_file_action" value is not set to "ROTATION", this is a finding.
Configure the operating system to use a locally developed list of auditable events by editing "/etc/audit/auditd.conf" files using the following command: sudo vi /etc/audit/auditd.conf Add or modify lines to have the required values for the organization.