The Oracle Linux operating system must implement the Endpoint Security for Linux Threat Prevention tool.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-221706	OL07-00-020019	SV-221706r754736_rule		Medium

Description
Adding endpoint security tools can provide the capability to take actions automatically in response to malicious behavior, which can provide additional agility in reacting to network threats. These tools often include a reporting capability to provide network awareness of the system, which may not otherwise exist in an organization's systems management regime. Satisfies: SRG-OS-000191-GPOS-00080, SRG-OS-000196

Description

Adding endpoint security tools can provide the capability to take actions automatically in response to malicious behavior, which can provide additional agility in reacting to network threats. These tools often include a reporting capability to provide network awareness of the system, which may not otherwise exist in an organization's systems management regime. Satisfies: SRG-OS-000191-GPOS-00080, SRG-OS-000196

STIG	Date
Oracle Linux 7 Security Technical Implementation Guide	2023-03-06

Details

Check Text ( C-23421r754734_chk )
Per OPORD 16-0080, the preferred intrusion detection system is McAfee Endpoint Security for Linux (ENSL) in conjunction with SELinux. Procedure: Check that the following package has been installed: # rpm -qa \| grep -i mcafeetp If the "mcafeetp" package is not installed, this is a finding. Verify that the daemon is running: # ps -ef \| grep -i mfetpd If the daemon is not running, this is a finding.

Check Text ( C-23421r754734_chk )

Per OPORD 16-0080, the preferred intrusion detection system is McAfee Endpoint Security for Linux (ENSL) in conjunction with SELinux.

Procedure:
Check that the following package has been installed:

# rpm -qa | grep -i mcafeetp

If the "mcafeetp" package is not installed, this is a finding.

Verify that the daemon is running:

# ps -ef | grep -i mfetpd

If the daemon is not running, this is a finding.

Fix Text (F-23410r754735_fix)
Install and enable the latest McAfee ENSLTP package.