The container platform components must provide the ability to send audit logs to a central enterprise repository for review and analysis.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-233052	SRG-APP-000111-CTR-000220	SV-233052r601639_rule		Medium

Description
The container platform components must send audit events to a central managed audit log repository to provide reporting, analysis, and alert notification. Incident response relies on successful timely, accurate system analysis in order for the organization to identify and respond to possible security events.

STIG	Date
Container Platform Security Requirements Guide	2021-12-14

Details

Check Text ( C-35988r601638_chk )
Review the configuration settings to determine if the container platform components are configured to send audit events to central managed audit log repository. If the container platform is not configured to send audit events to central managed audit log repository, this is a finding.

Fix Text (F-35956r600644_fix)
Configure the container platform components to send audit logs to a central managed audit log repository.