TMA-MONGO-REDACT-CLIENT-LOG
Ensure client data is redacted from logs
LowLevel 2Automatedmongodb
Description
security.redactClientLogData: true keeps document contents out of diagnostic logs (MongoDB Enterprise). Checks the YAML config file /etc/mongod.conf (SKIP when it does not exist).
How it is checked
Audit method: File pattern
- File
/etc/mongod.conf- Pattern
(?m)^[ \t]*redactClientLogData:[ \t]*true\b
How it is fixed
Fix method: Guidance or infrastructure patch
Set security.redactClientLogData: true in /etc/mongod.conf and restart mongod
Properties
- Operating systems
- Any
- Tags
- mongodbdatabaseloggingprivacy
- Reference
- CIS MongoDB Benchmark - Data Encryption / Log Redaction (verify section number for your release)
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target mongodb --level 2