Ensure ALL Events are Audited

ВисокаНиво 2Аутоматскаoceanbase

Опис

The database audit function must record all critical operations to support security incident traceability, compliance reviews, and behavioral analysis. Runs obclient with the connection options in OB_CONN (default "-h127.0.0.1 -P2881 -uroot@sys"); point it at the MySQL-mode tenant being assessed and supply the password via OB_CONN (-p...) or a [client] section in ~/.my.cnf. The benchmark rates this recommendation Manual; the automated check covers its objective pass criterion. Passes when audit_trail is not None (DB, DB,EXTENDED, DB_EXTENDED or OS) for the tenant on every server.

Како се проверава

Метод провере: SQL упит

sql_query

out=$(obclient ${OB_CONN:--h127.0.0.1 -P2881 -uroot@sys} -N -B -e "SELECT CASE WHEN COUNT(*) > 0 AND SUM(CASE WHEN UPPER(value) <> 'NONE' THEN 0 ELSE 1 END) = 0 THEN 'compliant' ELSE 'noncompliant' END FROM oceanbase.GV\$OB_PARAMETERS WHERE name = 'audit_trail'" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

ALTER SYSTEM SET audit_trail = 'DB_EXTENDED'; and on 4.2.4+ apply an audit filter: SELECT AUDIT_LOG_FILTER_SET_FILTER('log_all', '{"filter": {"log": true}}'); SELECT AUDIT_LOG_FILTER_SET_USER('%', 'log_all');

Својства

Оперативни системи: Било који
Ознаке: oceanbaseloggingaudit
Референца: CIS OceanBase Enterprise Edition V4 Benchmark v1.0.0 - 4.4.1 Ensure ALL Events are Audited

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target oceanbase --level 2