All audit records must identify where in the container platform the event occurred.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-233044	SRG-APP-000097-CTR-000180	SV-233044r599533_rule		Medium

Description
Within the container platform, audit data can be generated from any of the deployed container platform components. This audit data is important when there are issues, such as security incidents, that must be investigated. To make the audit data worthwhile for the investigation of events, it is necessary to know where within the container platform the event occurred.

STIG	Date
Container Platform Security Requirements Guide	2020-11-24

Details

Check Text ( C-35980r599532_chk )
Review the container platform configuration to determine if all audit records identify where in the container platform the event occurred. Generate audit records and view the audit records to verify that the records do identify where in the container platform the event occurred. If the container platform is not configured to generate audit records that identify where in the container platform the event occurred, or if the generated audit records do not identify where in the container platform the event occurred, this is a finding.

Check Text ( C-35980r599532_chk )

Review the container platform configuration to determine if all audit records identify where in the container platform the event occurred.

Generate audit records and view the audit records to verify that the records do identify where in the container platform the event occurred.

If the container platform is not configured to generate audit records that identify where in the container platform the event occurred, or if the generated audit records do not identify where in the container platform the event occurred, this is a finding.

Fix Text (F-35948r598769_fix)
Configure the container platform to generate audit records that identify where in the container platform the event occurred.