STIGhubSTIGhub
STIGsRMF ControlsCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • RMF Controls
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 4 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to IBM Hardware Management Console (HMC) STIG

V-25387

CAT II (Medium)

Audit records content must contain valid information to allow for proper incident reporting.

Rule ID

SV-31556r2_rule

STIG

IBM Hardware Management Console (HMC) STIG

Version

V1R5

CCIs

CCI-000130

Discussion

The content of audit data must validate that the information contains:<br /> <br />User IDs<br />Successful and unsuccessful attempts to access security files (e.g., audit records, password files, access control files, etc)<br />Date and time of the event<br />Type of event<br />Success or failure of event<br />Successful and unsuccessful logons<br />Denial of access resulting from excessive number of logon attempts<br />Failure to not contain this information may hamper attempts to trace events and not allow proper tracking of incidents during a forensic investigation<br />

Check Content

Have the System Administrator validate the audit records contain valid information to allow for a proper incident tracking. Use the View Console Events task to display contents of security logs. <br /><br />Use the View Console Events task to view security logs and validate that it has the following information:<br /><br />User IDs<br />Successful and unsuccessful attempts to access security files (e.g., audit records, password files, access control files, etc)<br />Date and time of the event<br />Type of event<br />Success or failure of event<br />Successful and unsuccessful logons<br />Denial of access resulting from excessive number of logon attempts<br />

Fix Text

Have the System Administrator check the content of audit records.<br /><br />Use the View Console Events task to view security logs and validate that it has the following information:<br /><br />User IDs<br />Successful and unsuccessful attempts to access security files (e.g., audit records, password files, access control files, etc)<br />Date and time of the event<br />Type of event<br />Success or failure of event<br />Successful and unsuccessful logons<br />Denial of access resulting from excessive number of logon attempts<br />