Detections
Analytics

1.214 SOL-11.1-100040

Information

The audit system must identify in which zone an event occurred.

GROUP ID: V-216241RULE ID: SV-216241r959010

Tracking the specific Solaris zones in the audit trail reduces the time required to determine the cause of a security event.

Solution

This check applies to the global zone only. Determine the zone that you are currently securing.

zonename

If the command output is "global", this check applies.

List the non-global zones on the system.

zoneadm list -vi | grep -v global

The Audit Configuration profile is required.

Enable the "zonename" auditing policy.

pfexec auditconfig -setpolicy +zonename

See Also

https://workbench.cisecurity.org/benchmarks/23873

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-216241r959010_rule, STIG-ID|SOL-11.1-100040, Vuln-ID|V-216241

Plugin: Unix

Control ID: c8d03599df5f1a17a7b1f8169a0d28ed20ea66d53cb81d5100b27493e38c6908