The mobile operating system must include organization defined additional, more detailed information in the audit records for audit events identified by type, location, or subject.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32958	SRG-OS-000042-MOS-000017	SV-43356r1_rule		Low

Description
Information system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control, includes timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. The audit configuration must be adaptable to include organization defined additional, more detailed information in the audit records for audit events identified by type, location, or subject. Examples of this information include VPN state, communications interface, and duration of event.

Description

Information system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control, includes timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. The audit configuration must be adaptable to include organization defined additional, more detailed information in the audit records for audit events identified by type, location, or subject. Examples of this information include VPN state, communications interface, and duration of event.

STIG	Date
Mobile Operating System Security Requirements Guide	2012-10-01

Details

Check Text ( C-41259r1_chk )
Review the audit logs for entries that include organization defined additional, more detailed information in the audit records for audit events identified by type, location, or subject. If an entry does not include organization defined additional, more detailed information in the audit records for audit events identified by type, location, or subject, this is a finding.

Fix Text (F-36873r1_fix)
Modify the audit configuration to include organization defined additional, more detailed information in the audit records for audit events identified by type, location, or subject.