Detections
Analytics

1.76 AZLX-23-002025

Information

Amazon Linux 2023 must label all off-loaded audit logs before sending them to the central log server.

GROUP ID: V-274069RULE ID: SV-274069r1120195

Enriched logging is needed to determine who, what, and when events occur on a system. Without this, determining root cause of an event will be much more difficult.

Solution

Configure Amazon Linux 2023 to be configured so that the Audit Daemon labels all off-loaded audit logs.

Edit the /etc/audit/auditd.conf file and add or update the "name_format" option:

name_format = hostname

The audit daemon must be restarted for changes to take effect.

See Also

https://workbench.cisecurity.org/benchmarks/26107

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4(1), CAT|II, CCI|CCI-001851, Rule-ID|SV-274069r1120195_rule, STIG-ID|AZLX-23-002025, Vuln-ID|V-274069

Plugin: Unix

Control ID: 10b65d331ab84cbc71258fb2f1a13dfd25b4fcd04d27ffc495635adc9ce87243