Skip to content

DRAFT - Australian Cyber Security Centre (ACSC) ISM Official - Base

Rules and Groups employed by this XCCDF Profile

  • Record Attempts to Alter the localtime File

    If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during daemon startup (the default), add the following line to a file with suffix <cod...
    Rule Medium Severity
  • Configure auditd Data Retention

    The audit system writes data to <code>/var/log/audit/audit.log</code>. By default, <code>auditd</code> rotates 5 logs by size (6MB), retaining a maximum of 30MB of data in total, and refuses to wri...
    Group
  • Configure auditd flush priority

    The <code>auditd</code> service can be configured to synchronously write audit event data to disk. Add or correct the following line in <code>/etc/audit/auditd.conf</code> to ensure that audit even...
    Rule Medium Severity
  • Set number of records to cause an explicit flush to audit logs

    To configure Audit daemon to issue an explicit flush to disk command after writing <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_freq" use="legacy"></xccdf-1.2:sub> records, s...
    Rule Medium Severity
  • Include Local Events in Audit Logs

    To configure Audit daemon to include local events in Audit logs, set local_events to yes in /etc/audit/auditd.conf. This is the default setting.
    Rule Medium Severity
  • Resolve information before writing to audit logs

    To configure Audit daemon to resolve all uid, gid, syscall, architecture, and socket address information before writing the events to disk, set <code>log_format</code> to <code>ENRICHED</code> in <...
    Rule Low Severity
  • Set type of computer node name logging in audit logs

    To configure Audit daemon to use a unique identifier as computer node name in the audit events, set <code>name_format</code> to <code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_au...
    Rule Medium Severity
  • Write Audit Logs to the Disk

    To configure Audit daemon to write Audit logs to the disk, set write_logs to yes in /etc/audit/auditd.conf. This is the default setting.
    Rule Medium Severity
  • System Accounting with auditd

    The <code>auditd</code> program can perform comprehensive monitoring of system activity. This section makes use of recommended configuration settings for specific policies or use cases. The rules i...
    Group
  • Configure auditing of unsuccessful file accesses

    Ensure that unsuccessful attempts to access a file are audited. The following rules configure audit as described above: <pre>## Unsuccessful file access (any other opens) This has to go last. -a a...
    Rule Medium Severity
  • Configure auditing of unsuccessful file accesses (AArch64)

    Ensure that unsuccessful attempts to access a file are audited. The following rules configure audit as described above: <pre>## Unsuccessful file access (any other opens) This has to go last. -a a...
    Rule Medium Severity
  • Configure auditing of unsuccessful file accesses (ppc64le)

    Ensure that unsuccessful attempts to access a file are audited. The following rules configure audit as described above: <pre>## Unsuccessful file access (any other opens) This has to go last. -a a...
    Rule Medium Severity
  • Configure auditing of successful file accesses

    Ensure that successful attempts to access a file are audited. The following rules configure audit as described above: <pre>## Successful file access (any other opens) This has to go last. ## These...
    Rule Medium Severity
  • Configure auditing of successful file accesses (AArch64)

    Ensure that successful attempts to access a file are audited. The following rules configure audit as described above: <pre>## Successful file access (any other opens) This has to go last. ## These...
    Rule Medium Severity
  • Configure auditing of successful file accesses (ppc64le)

    Ensure that successful attempts to access a file are audited. The following rules configure audit as described above: <pre>## Successful file access (any other opens) This has to go last. ## These...
    Rule Medium Severity

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules