Detections
Analytics

1.27 SOL-11.1-010380

Information

The audit system must alert the System Administrator (SA) if there is any type of audit failure.

GROUP ID: V-219966
RULE ID: SV-219966r958758

Proper alerts to system administrators and Information Assurance (IA) officials of audit failures ensure a timely response to critical system issues.

Solution

The root role is required.

This action applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this action applies.

Add an audit_warn alias to /etc/mail/aliases that will forward to designated system administrator(s).

# pfedit /etc/mail/aliases

Insert a line in the form:

audit_warn:user1,user2

Put the updated aliases file into service.

# newaliases

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5(2), CAT|I, CCI|CCI-001858, Rule-ID|SV-219966r958758_rule, STIG-ID|SOL-11.1-010380, Vuln-ID|V-219966

Plugin: Unix

Control ID: 7735fe7e6e4bc0b50087ad6b49a3e3f547e65c1661f5a3409d3e28e989ab28e8