Detections
Analytics

1.360 ALMA-09-046880

Information

AlmaLinux OS 9 must produce audit records containing information to establish the identity of any individual or process associated with the event.

GROUP ID: V-269468
RULE ID: SV-269468r1050351

Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility for the potentially harmful event.

Solution

Edit the /etc/audit/auditd.conf file and add or update the "log_format" option:

log_format = ENRICHED

The audit daemon must be restarted for changes to take effect.

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, CCI|CCI-001487, Rule-ID|SV-269468r1050351_rule, STIG-ID|ALMA-09-046880, Vuln-ID|V-269468

Plugin: Unix

Control ID: 7844f05fa84b438bbd6c507a54f61f0b66b61a512c6050a605a13fb2ce2c5a74