STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must enable audit logging for the USBGuard daemon.

DISA Rule

SV-280965r1165250_rule

Vulnerability Number

V-280965

Group Title

SRG-OS-000062-GPOS-00031

Rule Version

RHEL-10-200563

Severity

CAT II

CCI(s)

• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

Weight

10

Fix Recommendation

Configure RHEL 10 USBGuard AuditBackend to use the audit system.

Add or edit the following line in "/etc/usbguard/usbguard-daemon.conf":

AuditBackend=LinuxAudit

Check Contents

Note: If the system is a virtual machine with no virtual or physical USB peripherals attached, this is not applicable.

Verify RHEL 10 audit logging is enabled for the USBGuard daemon.

Confirm the setting with the following command:

$ sudo grep AuditBackend /etc/usbguard/usbguard-daemon.conf
AuditBackend=LinuxAudit

If "AuditBackend" is not set to "LinuxAudit", this is a finding.

Vulnerability Number

V-280965

Documentable

False

Rule Version

RHEL-10-200563

Severity Override Guidance

Note: If the system is a virtual machine with no virtual or physical USB peripherals attached, this is not applicable.

Verify RHEL 10 audit logging is enabled for the USBGuard daemon.

Confirm the setting with the following command:

$ sudo grep AuditBackend /etc/usbguard/usbguard-daemon.conf
AuditBackend=LinuxAudit

If "AuditBackend" is not set to "LinuxAudit", this is a finding.

Check Content Reference

M

Target Key

5733