The HYCU virtual appliance must generate log records for a locally developed list of auditable events.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-268244	SRG-APP-000516-NDM-000334	HYCU-ND-000280	SV-268244r1038775_rule	2024-10-29	1

Description
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the network device (e.g., module or policy filter).

ℹ️ Check
Log in to the HYCU VM console. Review the /etc/audit/auditd.conf file and verify the settings are in accordance with a locally developed list of auditable events. If it is not configured in accordance with organizational policies, this is a finding. Check for the value of the "max_log_file_action" option in "/etc/audit/auditd.conf" with the following command: sudo grep max_log_file_action /etc/audit/auditd.conf If the "max_log_file_action" value is not set to "ROTATION", this is a finding.

ℹ️ Check

Log in to the HYCU VM console. Review the /etc/audit/auditd.conf file and verify the settings are in accordance with a locally developed list of auditable events. If it is not configured in accordance with organizational policies, this is a finding. Check for the value of the "max_log_file_action" option in "/etc/audit/auditd.conf" with the following command: sudo grep max_log_file_action /etc/audit/auditd.conf If the "max_log_file_action" value is not set to "ROTATION", this is a finding.

✔️ Fix
Configure the operating system to use a locally developed list of auditable events by editing "/etc/audit/auditd.conf" files using the following command: sudo vi /etc/audit/auditd.conf Add or modify lines to have the required values for the organization.