The container platform must generate audit record for privileged activities.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-233264	SRG-APP-000504-CTR-001280	SV-233264r601281_rule		Medium

Description
The container platform components will generate audit records for privilege activities and container platform runtime, registry, and keystore must generate access audit records to detect possible malicious intent. All the components must use the same standard so that the events can be tied together to understand what took place within the overall container platform. It would be difficult to establish, correlate, and investigate events relating to an incident or identify those responsible without these activities. Audit records can be generated from various components within the container platform.

Description

The container platform components will generate audit records for privilege activities and container platform runtime, registry, and keystore must generate access audit records to detect possible malicious intent. All the components must use the same standard so that the events can be tied together to understand what took place within the overall container platform. It would be difficult to establish, correlate, and investigate events relating to an incident or identify those responsible without these activities. Audit records can be generated from various components within the container platform.

STIG	Date
Container Platform Security Requirements Guide	2021-12-14

Details

Check Text ( C-36200r601279_chk )
Review the documentation and configuration guides to determine if the container platform generates log records for privileged activities. If log records are not generated for privileged activities, this is a finding.

Fix Text (F-36168r601280_fix)
Configure the container platform to generate log records for privileged activities.