STIGQter: STIG Summary: SUSE Linux Enterprise Server 15 Security Technical Implementation Guide Version: 2 Release: 8 Benchmark Date: 01 Jul 2026:

The SUSE operating system must notify the System Administrator (SA) when Advanced Intrusion Detection Environment (AIDE) discovers anomalies in the operation of any security functions.

DISA Rule

SV-234864r1184462_rule

Vulnerability Number

V-234864

Group Title

SRG-OS-000447-GPOS-00201

Rule Version

SLES-15-010570

Severity

CAT II

CCI(s)

• CCI-002702 - Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined security functions are discovered.

Weight

10

Fix Recommendation

Configure the SUSE operating system to notify the SA when AIDE discovers anomalies in the operation of any security functions.

Create the aide crontab file in "/etc/cron.daily" and add following command replacing the "[E-MAIL]" parameter with a proper email address for the SA:

0 0 * * * /usr/bin/aide --check | /bin/mail -s "$HOSTNAME - Daily AIDE integrity check run" root@example_server_name.mil

Note: Per requirement SLES-15-010418, the "mailx" package must be installed on the system to enable email functionality.

Check Contents

Verify the SUSE operating system notifies the SA when AIDE discovers anomalies in the operation of any security functions.

Verify the aide cron job sends an email when executed with the following command:

> grep -i "aide" /etc/cron.*/aide
0 0 * * * /usr/bin/aide --check | /bin/mail -s "$HOSTNAME - Daily AIDE integrity check run" root@example_server_name.mil

If the "aide" file does not exist under the "/etc/cron" directory structure or the cron job is not configured to execute a binary to send an email (such as "/bin/mail"), this is a finding.

Vulnerability Number

V-234864

Documentable

False

Rule Version

SLES-15-010570

Severity Override Guidance

Verify the SUSE operating system notifies the SA when AIDE discovers anomalies in the operation of any security functions.

Verify the aide cron job sends an email when executed with the following command:

> grep -i "aide" /etc/cron.*/aide
0 0 * * * /usr/bin/aide --check | /bin/mail -s "$HOSTNAME - Daily AIDE integrity check run" root@example_server_name.mil

If the "aide" file does not exist under the "/etc/cron" directory structure or the cron job is not configured to execute a binary to send an email (such as "/bin/mail"), this is a finding.

Check Content Reference

M

Target Key

5274