Audit records must include the sources of the events that occurred.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-216256	SOL-11.1-010170	SV-216256r603267_rule		Medium

Description
Without accurate source information malicious activity cannot be accurately tracked.

STIG	Date
Solaris 11 SPARC Security Technical Implementation Guide	2022-11-18

Details

Check Text ( C-17492r370856_chk )
The Audit Configuration profile is required. This check applies to the global zone only. Determine the zone that you are currently securing. # zonename If the command output is "global", this check applies. Check the status of the audit system. It must be auditing. # pfexec auditconfig -getcond If this command does not report: audit condition = auditing this is a finding.

Fix Text (F-17490r370857_fix)
The Audit Control profile is required. This action applies to the global zone only. Determine the zone that you are currently securing. # zonename If the command output is "global", this action applies. If auditing has been disabled, it must be enabled with the following command: # pfexec audit -s