The Cassandra database must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.

From vRealize - Cassandra Security Technical Implementation Guide

Part of SRG-APP-000101-DB-000044

Associated with: CCI-000135

SV-87251r1_rule The Cassandra database must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.

Vulnerability discussion

Information system auditing capability is critical for accurate forensic analysis. Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. To support analysis, some types of events will need information to be logged that exceeds the basic requirements of event type, time stamps, location, source, outcome, and user identity. If additional information is not available, it could negatively impact forensic investigations into user actions or other malicious events.The organization must determine what additional information is required for complete analysis of the audited events. The additional information required is dependent on the type of information (e.g., sensitivity of the data and the environment within which it resides). At a minimum, the organization must employ either full-text recording of privileged commands or the individual identities of group users, or both. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Examples of detailed information the organization may require in audit records are full-text recording of privileged commands or the individual identities of group account users.

Check content

Review the Cassandra Server settings to ensure additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject are included. At the command prompt, execute the following command: # grep '

Fix text

Configure the Cassandra Server to include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject. At the command line execute the following command: # sed -i 's/^\(\s*\)\(\s*\)$/\1\2/' /usr/lib/vmware-vcops/user/conf/cassandra/logback.xml

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer