STIGQter: STIG Summary: SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

Advanced Intrusion Detection Environment (AIDE) must verify the baseline SLEM 5 configuration at least weekly.

DISA Rule

SV-261407r996637_rule

Vulnerability Number

V-261407

Group Title

SRG-OS-000363-GPOS-00150

Rule Version

SLEM-05-651030

Severity

CAT II

CCI(s)

• CCI-001744 - Implement organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner.
• CCI-002696 - Verify correct operation of organization-defined security functions.
• CCI-002699 - Perform verification of the correct operation of organization-defined security functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.

Weight

10

Fix Recommendation

Configure SLEM 5 to check the baseline configuration for unauthorized changes at least once weekly.

Add or modify the following line in the "/etc/cron.weekly/aide" file:

0 0 * * * /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Weekly AIDE integrity check run" root@example_server_name.mil

Check Contents

Verify SLEM 5 checks the baseline configuration using AIDE for unauthorized changes at least once weekly with the following command:

Note: A file integrity tool other than AIDE may be used, but the tool must be executed at least once per week.

> sudo grep -R aide /etc/crontab /etc/cron.*
/etc/crontab: 30 04 * * * root /usr/sbin/aide

If the file integrity application does not exist, or a "crontab" file does not exist in "/etc/crontab", the "/etc/cron.daily" subdirectory, or "/etc/cron.weekly" subdirectory, this is a finding.

Vulnerability Number

V-261407

Documentable

False

Rule Version

SLEM-05-651030

Severity Override Guidance

Verify SLEM 5 checks the baseline configuration using AIDE for unauthorized changes at least once weekly with the following command:

Note: A file integrity tool other than AIDE may be used, but the tool must be executed at least once per week.

> sudo grep -R aide /etc/crontab /etc/cron.*
/etc/crontab: 30 04 * * * root /usr/sbin/aide

If the file integrity application does not exist, or a "crontab" file does not exist in "/etc/crontab", the "/etc/cron.daily" subdirectory, or "/etc/cron.weekly" subdirectory, this is a finding.

Check Content Reference

M

Target Key

5596