SV-252973r1016309: TOSS audit records must contain information to establish what type of events occurred, when the events occurred, the source of events, where events occurred, and the outcome of events. | Tri-Lab Operating System Stack (TOSS) 4 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

TOSS audit records must contain information to establish what type of events occurred, when the events occurred, the source of events, where events occurred, and the outcome of events.

Description

Discussion Text

Without establishing what type of events occurred, when events occurred, the source of events, where events occurred, and the outcome of events, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Associating event types with detected events in TOSS audit logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured TOSS system. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000047-GPOS-00023, SRG-OS-000051-GPOS-00024, SRG-OS-000064-GPOS-00033, SRG-OS-000241-GPOS-00091, SRG-OS-000254-GPOS-00095, SRG-OS-000327-GPOS-00127, SRG-OS-000342-GPOS-00133, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000365-GPOS-00152, SRG-OS-000474-GPOS-00219, SRG-OS-000479-GPOS-00224

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000130Not mappedCCI-000131Not mappedCCI-000132Not mappedCCI-000133Not mappedCCI-000134Not mappedCCI-000135Not mappedCCI-000140Not mappedCCI-000154Not mappedCCI-000172Not mappedCCI-001405Not mappedCCI-001464Not mappedCCI-003938Not mappedCCI-001851Not mappedCCI-001875Not mappedCCI-001877Not mappedCCI-001878Not mappedCCI-001879Not mappedCCI-001881Not mappedCCI-001882Not mappedCCI-002234Not mappedCCI-001814

References

DPMS Target TOSS 4 DISA DPMS Target TOSS 4 5469

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.toss4os:def:252973
# TOSS audit records must contain information to establish what type of events occurred, when the events occurred, the source of events, where events occurred, and the outcome of events.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# package audit is installed
# rpminfo_object (rpminfo_test)
test_1() {
  rpm -q --quiet 'audit' &>/dev/null
}
# auditd is enabled and active
# process58_object (process58_test)
test_2() {
  ps -eo args | grep -P '^/sbin/auditd\b' &>/dev/null
}

if ( test_1 && test_2 ); then
  echo "PASS"
else
  echo "FAIL"
fi

Remediation

Configure the audit service to produce audit records containing the information needed to establish when (date and time) an event occurred.

Install the audit service (if the audit service is not already installed) with the following command:

$ sudo yum install audit

Enable the audit service with the following command:

$ sudo systemctl enable auditd.service

Start the audit service with the following command:

$ sudo systemctl start auditd.service