The operating system must generate audit records containing the full-text recording of privileged commands.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-203609 | SRG-OS-000042 | SRG-OS-000042-GPOS-00020 | SV-203609r958422_rule | 2024-12-04 | 3 |
| Description |
|---|
| Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. |
| ℹ️ Check |
|---|
| Verify the operating system generates audit records containing the full-text recording of privileged commands. If it does not, this is a finding. |
| ✔️ Fix |
|---|
| Configure the operating system to generate audit records containing the full-text recording of privileged commands. |