STIGQter: STIG Summary: HYCU Protege Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

The HYCU virtual appliance must generate audit records when successful/unsuccessful attempts to access privileges occur.

DISA Rule

SV-268238r1038665_rule

Vulnerability Number

V-268238

Group Title

SRG-APP-000091-NDM-000223

Rule Version

HYCU-ND-000220

Severity

CAT II

CCI(s)

• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

Weight

10

Fix Recommendation

Configure the operating system to generate audit records when successful/unsuccessful attempts to access privileges occur.

Log in to the HYCU VM console and run the following command:
chkconfig auditd on

Log in to the HYCU VM console and load the STIG audit rules by using the following commands:

1. sudo cp /usr/share/audit/sample-rules/10-base-config.rules /usr/share/audit/sample-rules/30-stig.rules /usr/share/audit/sample-rules/31-privileged.rules /usr/share/audit/sample-rules/99-finalize.rules /etc/audit/rules.d/

2. sudo augenrules --load

Check Contents

HYCU Web UI user access accounts cannot be edited, only removed and readded from/to user groups in the Web UI Self-Service menu.

After adding a user to a group, log in to the HYCU Web UI, navigate into Events context, and search for message of category "USER_GROUP" and text "Successfully added user to group". If the message is not in Events, this is a finding.

Log in to the VM console and run the following command:
chkconfig auditd

If the Audit Service is not in a running state, this is a finding.

Check the contents of the "/var/log/audit/audit.log" file. Verify the operating system generates audit records when successful/unsuccessful attempts to access privileges occur.

If the audit log is not configured or does not have required contents, this is a finding.

Vulnerability Number

V-268238

Documentable

False

Rule Version

HYCU-ND-000220

Severity Override Guidance

HYCU Web UI user access accounts cannot be edited, only removed and readded from/to user groups in the Web UI Self-Service menu.

After adding a user to a group, log in to the HYCU Web UI, navigate into Events context, and search for message of category "USER_GROUP" and text "Successfully added user to group". If the message is not in Events, this is a finding.

Log in to the VM console and run the following command:
chkconfig auditd

If the Audit Service is not in a running state, this is a finding.

Check the contents of the "/var/log/audit/audit.log" file. Verify the operating system generates audit records when successful/unsuccessful attempts to access privileges occur.

If the audit log is not configured or does not have required contents, this is a finding.

Check Content Reference

M

Target Key

5660