mediumauditverified ✓rollback-safe
Ensure events that modify the system's network environment are collected
audit-network-change · RHEL ≥ 8 · 1 impl
Description
Changes to the network environment must be collected.
Rationale
Without auditing these events, malicious activity could go undetected, compromising forensic capabilities.
Check → Remediate
Checkaudit_rule_exists
- rule:
- -k system-locale
Remediateaudit_rule_set
- rule:
- -a always,exit -F arch=b64 -S sethostname,setdomainname -k system-locale
- persist_file:
- /etc/audit/rules.d/50-system_locale.rules
Framework references
CIS
rhel8 6.3.3.5rhel9 6.3.3.5
NIST 800-53
AU-2AU-12CM-6
Live verification
rhel8:checkrhel9:check
#audit#auditd