Detections
Analytics

1.215 SOL-11.1-100040

Information

The audit system must identify in which zone an event occurred.

GROUP ID: V-216477
RULE ID: SV-216477r959010

Tracking the specific Solaris zones in the audit trail reduces the time required to determine the cause of a security event.

Solution

This check applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

List the non-global zones on the system.

# zoneadm list -vi | grep -v global

The Audit Configuration profile is required.

Enable the "zonename" auditing policy.

# pfexec auditconfig -setpolicy +zonename

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-216477r959010_rule, STIG-ID|SOL-11.1-100040, Vuln-ID|V-216477

Plugin: Unix

Control ID: 5a992af8dafd83ad36a4bf2555e0e6cda3eeaedee8b7965a77a7160fbe1ce50c