Detections
Analytics
CD16-00-000900 - PostgreSQL must initiate session auditing upon startup.
Information
Session auditing is for use when a user's activities are under investigation. To ensure the capture of all activity during those periods when session auditing is in use, it needs to be in operation for the whole time PostgreSQL is running.Solution
Configure PostgreSQL to enable auditing.To ensure logging is enabled, review supplementary content APPENDIX-C for instructions on enabling logging.
For session logging, using pgaudit is recommended. For instructions on how to setup pgaudit, refer to supplementary content APPENDIX-B.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_CD_Postgres_16_V1R2_STIG.zip
Item Details
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-14(1), CAT|II, CCI|CCI-001464, Rule-ID|SV-261865r1000600_rule, STIG-ID|CD16-00-000900, Vuln-ID|V-261865
Plugin: PostgreSQLDB
Control ID: 176f563c6490051c889cebc22fefb2aa709df516504cffc20a1184030fdfcde8