Oracle Solaris
TMA-SOLARIS-4.1
Create CIS Audit Class
MediumLevel 1Automatedsolaris
Description
To group a set of related audit events, the Solaris Audit service provides the ability for sites to define their own audit classes that contain just those events that the site wants to audit. To simplify administration, a CIS specific audit class should be created. Audit: pattern match on /etc/security/audit_class as described in the CIS audit procedure.
How it is checked
Audit method: File pattern
- File
/etc/security/audit_class- Pattern
(?m)^0x0100000000000000:cis:CIS Solaris Benchmark
How it is fixed
Fix method: Guidance or infrastructure patch
To create the CIS audit class, edit the /etc/security/audit_class file and add the following entry before the last line of the file: 0x0100000000000000:cis:CIS Solaris Benchmark
Properties
- Operating systems
- Any
- Tags
- solarisaudit
- Reference
- CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 4.1 Create CIS Audit Class
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target solaris