Detections
Analytics

5.1 Ensure that system activity is audited

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Track access and changes to database configurations and data. MongoDB Enterprise includes a system auditing facility that can record system events (e.g. user operations, connection events) on a MongoDB instance. These audit records permit forensic analysis and allow administrators to verify proper controls.

System level logs can be handy while troubleshooting an operational problem or handling a security incident.

Solution

Set the value of auditLog.destination to the appropriate value from the following options:

syslog

To enable auditing and print audit events to syslog

mongod --dbpath data/db --auditDestination syslog

console

To enable auditing and print audit events to standard output (i.e., stdout )

mongod --dbpath data/db --auditDestination console

Json File

To enable auditing and print audit events to a file in JSON format. Printing audit events to file in JSON format degrades server performance more than printing to a file in BSON format.

mongod --dbpath data/db --auditDestination file --auditFormat JSON --auditPath data/db/auditLog.json

Bson File

To enable auditing and print audit events to a file in BSON binary format

mongod --dbpath data/db --auditDestination file --auditFormat BSON --auditPath data/db/auditLog.bson

See Also

https://workbench.cisecurity.org/benchmarks/23415

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3

Plugin: Windows

Control ID: f3e567ffcf8887f7d5f58cb01ed434d60febd226803f6ca922d0a18d84ae9d4c