VAMI must produce log records containing sufficient information to establish what type of events occurred.
An XCCDF Rule
Description
After a security incident has occurred, investigators will often review log files to determine what happened. Understanding what type of event occurred is critical for investigation of a suspicious event. Satisfies: SRG-APP-000095-WSR-000056, SRG-APP-000096-WSR-000057, SRG-APP-000097-WSR-000058, SRG-APP-000098-WSR-000059, SRG-APP-000099-WSR-000061, SRG-APP-000100-WSR-000064, SRG-APP-000374-WSR-000172, SRG-APP-000375-WSR-000171
- ID
- SV-256650r888472_rule
- Version
- VCLD-70-000006
- Severity
- Medium
- Updated
Remediation Templates
A Manual Procedure
Navigate to and open:
/opt/vmware/etc/lighttpd/lighttpd.conf
Comment any existing "accesslog.format" lines by adding a "#" at the beginning of the line.