STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must generate audit records for all DOD-defined auditable events within all components in the platform.

DISA Rule

SV-257517r1208201_rule

Vulnerability Number

V-257517

Group Title

SRG-APP-000089-CTR-000150

Rule Version

CNTR-OS-000150

Severity

CAT II

CCI(s)

• CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.
• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
• CCI-000171 - Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.
• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

As the cluster administrator, update the APIServer.config.openshift.io/cluster object to set the profile to the defined level of detail. For example, to configure the profile to WriteRequestBodies, meaning that all write requests to any API server object are logged in their entirety, execute the following:
oc patch apiserver.config.openshift.io/cluster --type=merge -p '{'spec': {'audit': {'profile': 'WriteRequestBodies'}}}'

Where OpenShift Virtualization is enabled:

To remove the errorPolicy flag on the first disk (index 0) of a given VM, use this command:
$ oc patch vm <vm-name> --type='json' -p='[
{"op": "remove", "path":
"/spec/template/spec/domain/devices/disks/0/errorPolicy"},
]'

Check Contents

To determine at what level the OpenShift audit policy logging verbosity is configured, as a cluster-administrator execute the following command:
oc get apiserver.config.openshift.io/cluster -ojsonpath='{.spec.audit.profile}'

If the output from the options does not return WriteRequestBodies or AllRequestBodies, this is a finding.

Where OpenShift Virtualization is enabled:
$ oc get vm -ojson -A | jq '.items[] |
select(.spec.template.spec.domain.devices.disks[].errorPolicy ==
"ignore")| .metadata.namespace + "/" + .metadata.name'

If the results show errorPolicy is set to "ignore", this is a finding.

Vulnerability Number

V-257517

Documentable

False

Rule Version

CNTR-OS-000150

Severity Override Guidance

To determine at what level the OpenShift audit policy logging verbosity is configured, as a cluster-administrator execute the following command:
oc get apiserver.config.openshift.io/cluster -ojsonpath='{.spec.audit.profile}'

If the output from the options does not return WriteRequestBodies or AllRequestBodies, this is a finding.

Where OpenShift Virtualization is enabled:
$ oc get vm -ojson -A | jq '.items[] |
select(.spec.template.spec.domain.devices.disks[].errorPolicy ==
"ignore")| .metadata.namespace + "/" + .metadata.name'

If the results show errorPolicy is set to "ignore", this is a finding.

Check Content Reference

M

Target Key

5547