MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-265907	SRG-APP-000080-DB-000063	MD7X-00-000400	SV-265907r1028717_rule	2024-09-27	1

Description
MongoDB must provide audit record generation capability for DOD-defined auditable events within all DBMS/database components. Satisfies: SRG-APP-000080-DB-000063, SRG-APP-000089-DB-000064, SRG-APP-000090-DB-000065, SRG-APP-000091-DB-000066, SRG-APP-000091-DB-000325, SRG-APP-000092-DB-000208, SRG-APP-000095-DB-000039, SRG-APP-000096-DB-000040, SRG-APP-000097-DB-000041, SRG-APP-000098-DB-000042, SRG-APP-000099-DB-000043, SRG-APP-000100-DB-000201, SRG-APP-000101-DB-000044, SRG-APP-000109-DB-000049, SRG-APP-000356-DB-000315, SRG-APP-000381-DB-000361, SRG-APP-000492-DB-000332, SRG-APP-000492-DB-000333, SRG-APP-000494-DB-000344, SRG-APP-000494-DB-000345, SRG-APP-000495-DB-000326, SRG-APP-000495-DB-000327, SRG-APP-000495-DB-000328, SRG-APP-000495-DB-000329, SRG-APP-000496-DB-000334, SRG-APP-000496-DB-000335, SRG-APP-000498-DB-000346, SRG-APP-000498-DB-000347, SRG-APP-000499-DB-000330, SRG-APP-000499-DB-000331, SRG-APP-000501-DB-000336, SRG-APP-000501-DB-000337, SRG-APP-000502-DB-000348, SRG-APP-000502-DB-000349, SRG-APP-000503-DB-000350, SRG-APP-000503-DB-000351, SRG-APP-000504-DB-000354, SRG-APP-000504-DB-000355, SRG-APP-000505-DB-000352, SRG-APP-000506-DB-000353, SRG-APP-000507-DB-000356, SRG-APP-000507-DB-000357, SRG-APP-000508-DB-000358

Description

MongoDB must provide audit record generation capability for DOD-defined auditable events within all DBMS/database components. Satisfies: SRG-APP-000080-DB-000063, SRG-APP-000089-DB-000064, SRG-APP-000090-DB-000065, SRG-APP-000091-DB-000066, SRG-APP-000091-DB-000325, SRG-APP-000092-DB-000208, SRG-APP-000095-DB-000039, SRG-APP-000096-DB-000040, SRG-APP-000097-DB-000041, SRG-APP-000098-DB-000042, SRG-APP-000099-DB-000043, SRG-APP-000100-DB-000201, SRG-APP-000101-DB-000044, SRG-APP-000109-DB-000049, SRG-APP-000356-DB-000315, SRG-APP-000381-DB-000361, SRG-APP-000492-DB-000332, SRG-APP-000492-DB-000333, SRG-APP-000494-DB-000344, SRG-APP-000494-DB-000345, SRG-APP-000495-DB-000326, SRG-APP-000495-DB-000327, SRG-APP-000495-DB-000328, SRG-APP-000495-DB-000329, SRG-APP-000496-DB-000334, SRG-APP-000496-DB-000335, SRG-APP-000498-DB-000346, SRG-APP-000498-DB-000347, SRG-APP-000499-DB-000330, SRG-APP-000499-DB-000331, SRG-APP-000501-DB-000336, SRG-APP-000501-DB-000337, SRG-APP-000502-DB-000348, SRG-APP-000502-DB-000349, SRG-APP-000503-DB-000350, SRG-APP-000503-DB-000351, SRG-APP-000504-DB-000354, SRG-APP-000504-DB-000355, SRG-APP-000505-DB-000352, SRG-APP-000506-DB-000353, SRG-APP-000507-DB-000356, SRG-APP-000507-DB-000357, SRG-APP-000508-DB-000358

ℹ️ Check
Check the MongoDB configuration file (default location: /etc/mongod.conf) for a key named "auditLog:". Examples shown below: auditLog: destination: file format: BSON path: <mongodb audit log directory>/auditLog.bson filter: '{ atype: { $in: [ "createCollection", "dropCollection" ] } }' -OR- auditLog: destination: syslog If an "auditLog:" key is not present, this is a finding. If the "auditLog:" key is present, ensure the subkey of "destination:" is set to either "file" or "syslog". If not, this is a finding. If the "auditLog:" key is present and contains a subkey of "filter:", ensure the filter is valid. If the filter is invalid, this is a finding. The site auditing policy must be reviewed to determine if the "filter:" being applied meets the site auditing requirements. If not, this is a finding. Check the MongoDB configuration file (default location: /etc/mongod.conf) for the following entry: setParameter: auditAuthorizationSuccess: true If this setParameter entry does not have "auditAuthorizationSuccess: true", this is a finding.

ℹ️ Check

Check the MongoDB configuration file (default location: /etc/mongod.conf) for a key named "auditLog:". Examples shown below: auditLog: destination: file format: BSON path: <mongodb audit log directory>/auditLog.bson filter: '{ atype: { $in: [ "createCollection", "dropCollection" ] } }' -OR- auditLog: destination: syslog If an "auditLog:" key is not present, this is a finding. If the "auditLog:" key is present, ensure the subkey of "destination:" is set to either "file" or "syslog". If not, this is a finding. If the "auditLog:" key is present and contains a subkey of "filter:", ensure the filter is valid. If the filter is invalid, this is a finding. The site auditing policy must be reviewed to determine if the "filter:" being applied meets the site auditing requirements. If not, this is a finding. Check the MongoDB configuration file (default location: /etc/mongod.conf) for the following entry: setParameter: auditAuthorizationSuccess: true If this setParameter entry does not have "auditAuthorizationSuccess: true", this is a finding.

✔️ Fix
Edit the MongoDB configuration file (default location: /etc/mongod.conf) and add a configured "auditLog" setting: auditLog: destination: file format: BSON path: <mongodb audit log directory>/auditLog.bson -OR- auditLog: destination: syslog Add the following entry to the MongoDB configuration file: setParameter: auditAuthorizationSuccess: true Restart the MongoDB service from the OS. $ sudo systemctl restart mongod Setting of auditAuthorizationSuccess enables auditing of authorization success for the authCheck action. The parameter value must be true to audit read and write operations. However, when auditAuthorizationSuccess is false, auditing has less performance impact because the audit system only logs authorization failures. If the "auditLog" setting was present and contained a "filter:" parameter, ensure the "filter:" expression does not prevent the auditing of events that should be audited. The filter can be modified accordingly to ensure it complies. Alternatively, remove the "filter:" parameter to enable auditing for all events. Refer to the MongoDB documentation for details of audit operations and event configuration: https://www.mongodb.com/docs/v7.0/core/auditing/ https://www.mongodb.com/docs/v7.0/tutorial/configure-audit-filters/

✔️ Fix

Edit the MongoDB configuration file (default location: /etc/mongod.conf) and add a configured "auditLog" setting: auditLog: destination: file format: BSON path: <mongodb audit log directory>/auditLog.bson -OR- auditLog: destination: syslog Add the following entry to the MongoDB configuration file: setParameter: auditAuthorizationSuccess: true Restart the MongoDB service from the OS. $ sudo systemctl restart mongod Setting of auditAuthorizationSuccess enables auditing of authorization success for the authCheck action. The parameter value must be true to audit read and write operations. However, when auditAuthorizationSuccess is false, auditing has less performance impact because the audit system only logs authorization failures. If the "auditLog" setting was present and contained a "filter:" parameter, ensure the "filter:" expression does not prevent the auditing of events that should be audited. The filter can be modified accordingly to ensure it complies. Alternatively, remove the "filter:" parameter to enable auditing for all events. Refer to the MongoDB documentation for details of audit operations and event configuration: https://www.mongodb.com/docs/v7.0/core/auditing/ https://www.mongodb.com/docs/v7.0/tutorial/configure-audit-filters/