Detections
Analytics
AZLX-23-002025 - Amazon Linux 2023 must label all off-loaded audit logs before sending them to the central log server.
Information
Enriched logging is needed to determine who, what, and when events occur on a system. Without this, determining root cause of an event will be much more difficult.Solution
Configure Amazon Linux 2023 to be configured so that the Audit Daemon labels all off-loaded audit logs.Edit the /etc/audit/auditd.conf file and add or update the "name_format" option:
name_format = hostname
The audit daemon must be restarted for changes to take effect.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Amazon_Linux_2023_V1R2_STIG.zip
Item Details
Audit Name: DISA Amazon Linux 2023 STIG v1r2
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-4(1), CAT|II, CCI|CCI-001851, Rule-ID|SV-274069r1120195_rule, STIG-ID|AZLX-23-002025, Vuln-ID|V-274069
Plugin: Unix
Control ID: 87e1a6c922ac37d6fe7a30535d0b3ab13fcdf24e9a1422fa31dd13fe120514eb