The container platform must generate audit records containing the full-text recording of privileged commands or the individual identities of group account users.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-233049	SRG-APP-000101-CTR-000205	SV-233049r599543_rule		Medium

Description
During an investigation of an incident, it is important to fully understand what took place. Often, information is not part of the audited event due to the data's nature, security risk, or audit log size. Organizations must consider limiting the additional audit information to only that information explicitly needed for specific audit requirements. At a minimum, the organization must audit either full-text recording of privileged commands, or the individual identities of group users, or both.

Description

During an investigation of an incident, it is important to fully understand what took place. Often, information is not part of the audited event due to the data's nature, security risk, or audit log size. Organizations must consider limiting the additional audit information to only that information explicitly needed for specific audit requirements. At a minimum, the organization must audit either full-text recording of privileged commands, or the individual identities of group users, or both.

STIG	Date
Container Platform Security Requirements Guide	2020-11-24

Details

Check Text ( C-35985r599542_chk )
Review the documentation and deployment configuration to determine if the container platform is configured to generate full-text recording of privileged commands or the individual identities of group users at a minimum. Have a user execute a privileged command and review the log data to validate that the full-text or identity of the individual is being logged. If the container platform is not meeting this requirement, this is a finding.

Check Text ( C-35985r599542_chk )

Review the documentation and deployment configuration to determine if the container platform is configured to generate full-text recording of privileged commands or the individual identities of group users at a minimum.

Have a user execute a privileged command and review the log data to validate that the full-text or identity of the individual is being logged.

If the container platform is not meeting this requirement, this is a finding.

Fix Text (F-35953r598784_fix)
Configure the container platform to generate the full-text recording of privileged commands, or the individual identities of group users, or both.