STIGQter: STIG Summary: MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 24 Jul 2020:

MongoDB must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75% of maximum audit record storage capacity.

DISA Rule

SV-96621r1_rule

Vulnerability Number

V-81907

Group Title

SRG-APP-000359-DB-000319

Rule Version

MD3X-00-000630

Severity

CAT II

CCI(s)

• CCI-001855 - The information system provides a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit record storage volume reaches an organization-defined percentage of repository maximum audit record storage capacity.

Weight

10

Fix Recommendation

View the mongodb configuration file (default location: /etc/mongod.conf) and view the "auditlog.path" to identify the storage volume.

Install MongoDB Ops Manager or other organization approved monitoring software.

Configure the required alert in the monitoring software to send an alert where storage volume holding the auditLog file utilization reaches 75%.

Check Contents

A MongoDB audit log that is configured to be stored in a file is identified in the MongoDB configuration file (default: /etc/mongod.conf) under the "auditLog:" key and subkey "destination:" where "destination" is "file".

If this is the case then the "AuditLog:" subkey "path:" determines where (device/directory) that file will be located.

View the mongodb configuration file (default location: /etc/mongod.conf) and identify how the "auditlog.destination" is configured.

When the "auditlog.destination" is "file", this is a finding.

Vulnerability Number

V-81907

Documentable

False

Rule Version

MD3X-00-000630

Severity Override Guidance

A MongoDB audit log that is configured to be stored in a file is identified in the MongoDB configuration file (default: /etc/mongod.conf) under the "auditLog:" key and subkey "destination:" where "destination" is "file".

If this is the case then the "AuditLog:" subkey "path:" determines where (device/directory) that file will be located.

View the mongodb configuration file (default location: /etc/mongod.conf) and identify how the "auditlog.destination" is configured.

When the "auditlog.destination" is "file", this is a finding.

Check Content Reference

M

Target Key

3265

Comments