STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must take appropriate action upon an audit failure.

DISA Rule

SV-257523r1050555_rule

Vulnerability Number

V-257523

Group Title

SRG-APP-000109-CTR-000215

Rule Version

CNTR-OS-000210

Severity

CAT II

CCI(s)

• CCI-000140 - Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.

Weight

10

Fix Recommendation

Apply the following Prometheus rule by executing the following:

oc apply -f - << 'EOF'
---
# platform = multi_platform_ocp
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: audit-errors
namespace: openshift-kube-apiserver
spec:
groups:
- name: apiserver-audit
rules:
- alert: AuditLogError
annotations:
summary: |-
An API Server instance was unable to write audit logs. This could be
triggered by the node running out of space, or a malicious actor
tampering with the audit logs.
description: An API Server had an error writing to an audit log.
expr: |
sum by (apiserver,instance)(rate(apiserver_audit_error_total{apiserver=~".+-apiserver"}[5m])) / sum by (apiserver,instance) (rate(apiserver_audit_event_total{apiserver=~".+-apiserver"}[5m])) > 0
for: 1m
labels:
severity: warning
EOF

Check Contents

Verify there is a Prometheus rule to watch for audit events by executing the following:

oc get prometheusrule -o yaml --all-namespaces | grep apiserver_audit

Output:
sum by (apiserver,instance)(rate(apiserver_audit_error_total{apiserver=~".+-apiserver"}[5m])) / sum by (apiserver,instance) (rate(apiserver_audit_event_total{apiserver=~".+-apiserver"}[5m])) > 0

If the output above is not displayed, this is a finding.

Vulnerability Number

V-257523

Documentable

False

Rule Version

CNTR-OS-000210

Severity Override Guidance

Verify there is a Prometheus rule to watch for audit events by executing the following:

oc get prometheusrule -o yaml --all-namespaces | grep apiserver_audit

Output:
sum by (apiserver,instance)(rate(apiserver_audit_error_total{apiserver=~".+-apiserver"}[5m])) / sum by (apiserver,instance) (rate(apiserver_audit_event_total{apiserver=~".+-apiserver"}[5m])) > 0

If the output above is not displayed, this is a finding.

Check Content Reference

M

Target Key

5547