STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

All audit records must identify what type of event has occurred within OpenShift.

DISA Rule

SV-257520r960891_rule

Vulnerability Number

V-257520

Group Title

SRG-APP-000095-CTR-000170

Rule Version

CNTR-OS-000180

Severity

CAT II

CCI(s)

• CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.
• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
• CCI-002884 - Log organization-defined audit events for nonlocal maintenance and diagnostic sessions.

Weight

10

Fix Recommendation

Apply the machine config setting auditd to active and enabled by executing the following:

for mcpool in $(oc get mcp -oname | sed "s:.*/::" ); do
echo "apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
name: 80-auditd-service-enable-$mcpool
labels:
machineconfiguration.openshift.io/role: $mcpool
spec:
config:
ignition:
version: 3.1.0
systemd:
units:
- name: auditd.service
enabled: true
" | oc apply -f -
done

Check Contents

Verify the audit service is enabled and active by executing the following:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; systemctl is-enabled auditd.service; systemctl is-active auditd.service' 2>/dev/null; done

If the auditd service is not "enabled" and "active" this is a finding.

Vulnerability Number

V-257520

Documentable

False

Rule Version

CNTR-OS-000180

Severity Override Guidance

Verify the audit service is enabled and active by executing the following:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; systemctl is-enabled auditd.service; systemctl is-active auditd.service' 2>/dev/null; done

If the auditd service is not "enabled" and "active" this is a finding.

Check Content Reference

M

Target Key

5547