STIGQter STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

MariaDB must initiate session auditing upon startup.

DISA Rule

SV-253674r960888_rule

Vulnerability Number

V-253674

Group Title

SRG-APP-000092-DB-000208

Rule Version

MADB-10-000900

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

If not already exists, create a named filter with the required auditing for the user in question. Example:

MariaDB> INSERT INTO mysql.server_audit_filters (filtername, rule)
VALUES ('session_auditing',
JSON_COMPACT(
'{
"connect_event": [
"CONNECT",
"DISCONNECT"
],
"table_event":[
"WRITE",
"CREATE",
"DROP",
"RENAME",
"ALTER"
]
}'
));

Then assign the named filter to the user. Example:

MariaDB> INSERT INTO mysql.server_audit_users (host, user, filtername) VALUES ("%", "username", "session_auditing");

Reload filters.

MariaDB> SET GLOBAL server_audit_reload_filters = ON;

Check Contents

Verify the MariaDB Enterprise Audit plugin is loaded and actively logging:

MariaDB> SHOW GLOBAL STATUS LIKE 'Server_audit_active';

If the MariaDB Enterprise Audit is not active, this is a finding.

Check what filters are in place for user by running the following as an administrative user:

MariaDB> SELECT sau.host, sau.user, saf.filtername,
JSON_DETAILED(saf.rule)
FROM mysql.server_audit_filters saf
JOIN mysql.server_audit_users sau
ON saf.filtername = sau.filtername
WHERE saf.filtername != 'default'\G

Verify the corresponding audit filters are in place. If not, this is a finding.

Vulnerability Number

V-253674

Documentable

False

Rule Version

MADB-10-000900

Severity Override Guidance

Verify the MariaDB Enterprise Audit plugin is loaded and actively logging:

MariaDB> SHOW GLOBAL STATUS LIKE 'Server_audit_active';

If the MariaDB Enterprise Audit is not active, this is a finding.

Check what filters are in place for user by running the following as an administrative user:

MariaDB> SELECT sau.host, sau.user, saf.filtername,
JSON_DETAILED(saf.rule)
FROM mysql.server_audit_filters saf
JOIN mysql.server_audit_users sau
ON saf.filtername = sau.filtername
WHERE saf.filtername != 'default'\G

Verify the corresponding audit filters are in place. If not, this is a finding.

Check Content Reference

M

Target Key

5475