STIGQter: STIG Summary: Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Jul 2026:

Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.

DISA Rule

SV-270657r1066460_rule

Vulnerability Number

V-270657

Group Title

SRG-OS-000365-GPOS-00152

Rule Version

UBTU-24-100410

Severity

CAT II

CCI(s)

• CCI-003938 - Automatically generate audit records of the enforcement actions.
• CCI-001914 - Provide the capability for organization-defined individuals or roles to change the logging to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds.
• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
• CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.
• CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.
• CCI-000131 - Ensure that audit records containing information that establishes when the event occurred.
• CCI-000132 - Ensure that audit records containing information that establishes where the event occurred.
• CCI-000133 - Ensure that audit records containing information that establishes the source of the event.
• CCI-000134 - Ensure that audit records containing information that establishes the outcome of the event.
• CCI-000154 - Provide the capability to centrally review and analyze audit records from multiple components within the system.
• CCI-000158 - Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.
• CCI-001876 - Provide an audit reduction capability that supports on-demand reporting requirements.
• CCI-001875 - Provide an audit reduction capability that supports on-demand audit review and analysis.
• CCI-001877 - Provide an audit reduction capability that supports after-the-fact investigations of incidents.
• CCI-001878 - Provide a report generation capability that supports on-demand audit review and analysis.
• CCI-001879 - Provide a report generation capability that supports on-demand reporting requirements.
• CCI-001880 - Provide a report generation capability that supports after-the-fact investigations of security incidents.
• CCI-001881 - Provide an audit reduction capability that does not alter original content or time ordering of audit records.
• CCI-001882 - Provide a report generation capability that does not alter original content or time ordering of audit records.

Weight

10

Fix Recommendation

Configure the audit service to produce audit records containing the information needed to establish when (date and time) an event occurred.

Enable the audit service with the following command:

$ sudo systemctl enable auditd.service

To reload the rules file, issue the following command:

$ sudo augenrules --load

Check Contents

Verify the audit service is enabled with the following command:

$ systemctl is-enabled auditd.service
enabled

If the command above returns "disabled", this is a finding.

Verify the audit service is properly running and active on the system with the following command:

$ systemctl is-active auditd.service
active

If the command above returns "inactive", this is a finding.

Vulnerability Number

V-270657

Documentable

False

Rule Version

UBTU-24-100410

Severity Override Guidance

Verify the audit service is enabled with the following command:

$ systemctl is-enabled auditd.service
enabled

If the command above returns "disabled", this is a finding.

Verify the audit service is properly running and active on the system with the following command:

$ systemctl is-active auditd.service
active

If the command above returns "inactive", this is a finding.

Check Content Reference

M

Target Key

5673