Detections
Analytics
SLEM-05-653070 - Audispd must offload audit records onto a different system or media from SLEM 5 being audited.
Information
Information stored in one location is vulnerable to accidental or incidental deletion or alteration.Offloading is a common process in information systems with limited audit storage capacity.
Solution
Configure SLEM 5 to offload audit records onto a different system or media.Add or modify the following line in the "/etc/audisp/audisp-remote.conf" file:
remote_server = <ip_address>
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SLEM_5_V1R4_STIG.zip
Item Details
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-4(1), CAT|II, CCI|CCI-001851, Rule-ID|SV-261422r996674_rule, STIG-ID|SLEM-05-653070, Vuln-ID|V-261422
Plugin: Unix
Control ID: 646d64b39aece82c764636c4da4e8916f3e9b5cea9e3cec9b440c7bb76cfb76c