SRG-OS-000479-GPOS-00224

The operating system must, at a minimum, off-load audit data from interconnected systems in real time and off-load audit data from standalone systems weekly.

Details
Associations

31 rules found Severity: Medium

30 rules found Severity: Medium

31 rules found Severity: Medium

62 rules found Severity: Medium

31 rules found Severity: Medium

17 rules found Severity: Medium

15 rules found Severity: Medium

14 rules found Severity: Medium

4 rules found Severity: Medium

16 rules found Severity: Medium

2 rules found Severity: Medium

7 rules found Severity: Medium

1 rule found Severity: Medium

SRG-OS-000479-GPOS-00224

Configure auditd to use audispd's syslog plugin

Appropriate Action Must be Setup When the Internal Audit Event Queue is Full

Ensure rsyslog is Installed

Ensure Rsyslog Authenticates Off-Loaded Audit Records

Ensure Rsyslog Encrypts Off-Loaded Audit Records

Ensure Logs Sent To Remote Host

Configure audispd Plugin To Send Logs To Remote Server

Configure audispd's Plugin disk_full_action When Disk Is Full

Encrypt Audit Records Sent With audispd Plugin

Configure audispd's Plugin network_failure_action On Network Failure

Configure auditd to use audispd's remote logging daemon

Ensure the audispd's remote logging daemon direction is correct

Ensure the audispd's remote logging daemon executable is correct

Ensure the audispd's remote logging daemon type is correct

Set type of computer node name logging in audit logs

Offload audit Logs to External Media

Install systemd-journal-remote Package

Enable systemd-journal-upload Service

Configure systemd-journal-upload TLS parameters: ServerKeyFile,ServerCertificateFile and TrustedCertificateFile

Configure systemd-journal-upload URL