STIGQter: STIG Summary: SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SLEM 5 must notify the system administrator (SA) when Advanced Intrusion Detection Environment (AIDE) discovers anomalies in the operation of any security functions.

DISA Rule

SV-261408r996640_rule

Vulnerability Number

V-261408

Group Title

SRG-OS-000447-GPOS-00201

Rule Version

SLEM-05-651035

Severity

CAT II

CCI(s)

• CCI-002702 - Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined security functions are discovered.

Weight

10

Fix Recommendation

Configure SLEM 5 to notify the SA when AIDE discovers anomalies in the operation of any security functions.

Add or modify the following line in the "/etc/cron.daily/aide" file:

0 0 * * * /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily AIDE integrity check run" root@example_server_name.mil

Check Contents

Verify SLEM 5 notifies the SA when AIDE discovers anomalies in the operation of any security functions.

Note: A file integrity tool other than AIDE may be used, but the tool must be configured to notify the system administrator and/or ISSO if there is an anomaly.

Verify the aide cron job sends an email when executed with the following command:

> sudo grep -i "aide" /etc/cron.*/aide

0 0 * * * /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily AIDE integrity check run" root@example_server_name.mil

If the "aide" file does not exist under the "/etc/cron" directory structure or the cron job is not configured to execute a binary to send an email (such as "/bin/mail"), this is a finding.

Vulnerability Number

V-261408

Documentable

False

Rule Version

SLEM-05-651035

Severity Override Guidance

Verify SLEM 5 notifies the SA when AIDE discovers anomalies in the operation of any security functions.

Note: A file integrity tool other than AIDE may be used, but the tool must be configured to notify the system administrator and/or ISSO if there is an anomaly.

Verify the aide cron job sends an email when executed with the following command:

> sudo grep -i "aide" /etc/cron.*/aide

0 0 * * * /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily AIDE integrity check run" root@example_server_name.mil

If the "aide" file does not exist under the "/etc/cron" directory structure or the cron job is not configured to execute a binary to send an email (such as "/bin/mail"), this is a finding.

Check Content Reference

M

Target Key

5596