STIGQter: STIG Summary: MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.

DISA Rule

SV-265907r1028717_rule

Vulnerability Number

V-265907

Group Title

SRG-APP-000080-DB-000063

Rule Version

MD7X-00-000400

Severity

CAT II

CCI(s)

• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
• CCI-000171 - Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.
• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
• CCI-001464 - Initiates session audits automatically at system start-up.
• CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.
• CCI-000131 - Ensure that audit records containing information that establishes when the event occurred.
• CCI-000132 - Ensure that audit records containing information that establishes where the event occurred.
• CCI-000133 - Ensure that audit records containing information that establishes the source of the event.
• CCI-000134 - Ensure that audit records containing information that establishes the outcome of the event.
• CCI-001487 - Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.
• CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.
• CCI-000140 - Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.

Weight

10

Fix Recommendation

Edit the MongoDB configuration file (default location: /etc/mongod.conf) and add a configured "auditLog" setting:

auditLog:
destination: file
format: BSON
path: <mongodb audit log directory>/auditLog.bson

-OR-

auditLog:
destination: syslog

Add the following entry to the MongoDB configuration file:

setParameter:
auditAuthorizationSuccess: true

Restart the MongoDB service from the OS.

$ sudo systemctl restart mongod

Setting of auditAuthorizationSuccess enables auditing of authorization success for the authCheck action. The parameter value must be true to audit read and write operations. However, when auditAuthorizationSuccess is false, auditing has less performance impact because the audit system only logs authorization failures.

If the "auditLog" setting was present and contained a "filter:" parameter, ensure the "filter:" expression does not prevent the auditing of events that should be audited. The filter can be modified accordingly to ensure it complies. Alternatively, remove the "filter:" parameter to enable auditing for all events.

Refer to the MongoDB documentation for details of audit operations and event configuration:
https://www.mongodb.com/docs/v7.0/core/auditing/

https://www.mongodb.com/docs/v7.0/tutorial/configure-audit-filters/

Check Contents

Check the MongoDB configuration file (default location: /etc/mongod.conf) for a key named "auditLog:".

Examples shown below:

auditLog:
destination: file
format: BSON
path: <mongodb audit log directory>/auditLog.bson
filter: '{ atype: { $in: [ "createCollection", "dropCollection" ] } }'

-OR-

auditLog:
destination: syslog

If an "auditLog:" key is not present, this is a finding.

If the "auditLog:" key is present, ensure the subkey of "destination:" is set to either "file" or "syslog". If not, this is a finding.

If the "auditLog:" key is present and contains a subkey of "filter:", ensure the filter is valid. If the filter is invalid, this is a finding.

The site auditing policy must be reviewed to determine if the "filter:" being applied meets the site auditing requirements. If not, this is a finding.

Check the MongoDB configuration file (default location: /etc/mongod.conf) for the following entry:

setParameter:
auditAuthorizationSuccess: true

If this setParameter entry does not have "auditAuthorizationSuccess: true", this is a finding.

Vulnerability Number

V-265907

Documentable

False

Rule Version

MD7X-00-000400

Severity Override Guidance

Check the MongoDB configuration file (default location: /etc/mongod.conf) for a key named "auditLog:".

Examples shown below:

auditLog:
destination: file
format: BSON
path: <mongodb audit log directory>/auditLog.bson
filter: '{ atype: { $in: [ "createCollection", "dropCollection" ] } }'

-OR-

auditLog:
destination: syslog

If an "auditLog:" key is not present, this is a finding.

If the "auditLog:" key is present, ensure the subkey of "destination:" is set to either "file" or "syslog". If not, this is a finding.

If the "auditLog:" key is present and contains a subkey of "filter:", ensure the filter is valid. If the filter is invalid, this is a finding.

The site auditing policy must be reviewed to determine if the "filter:" being applied meets the site auditing requirements. If not, this is a finding.

Check the MongoDB configuration file (default location: /etc/mongod.conf) for the following entry:

setParameter:
auditAuthorizationSuccess: true

If this setParameter entry does not have "auditAuthorizationSuccess: true", this is a finding.

Check Content Reference

M

Target Key

5637