STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must prevent unauthorized changes to the audit system.

DISA Rule

SV-281365r1167245_rule

Vulnerability Number

V-281365

Group Title

SRG-OS-000057-GPOS-00027

Rule Version

RHEL-10-900100

Severity

CAT II

CCI(s)

• CCI-000162 - Protect audit information from unauthorized access.
• CCI-000163 - Protect audit information from unauthorized modification.
• CCI-000164 - Protect audit information from unauthorized deletion.

Weight

10

Fix Recommendation

Configure RHEL 10 to protect the audit system from unauthorized changes.

Set the audit rules to be immutable by adding the following line to end of "/etc/audit/rules.d/audit.rules":

-e 2

Restart the audit daemon with the following command for the changes to take effect:

$ sudo service auditd restart

Check Contents

Verify the RHEL 10 audit system prevents unauthorized changes with the following command:

$ sudo grep "^\s*[^#]" /etc/audit/audit.rules | tail -1
-e 2

If the audit system is not set to be immutable by adding the "-e 2" option to the end of "/etc/audit/audit.rules", this is a finding.

Vulnerability Number

V-281365

Documentable

False

Rule Version

RHEL-10-900100

Severity Override Guidance

Verify the RHEL 10 audit system prevents unauthorized changes with the following command:

$ sudo grep "^\s*[^#]" /etc/audit/audit.rules | tail -1
-e 2

If the audit system is not set to be immutable by adding the "-e 2" option to the end of "/etc/audit/audit.rules", this is a finding.

Check Content Reference

M

Target Key

5733