The HYCU virtual appliance must generate log records for a locally developed list of auditable events.

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.

Audit records can be generated from various components within the network device (e.g., module or policy filter).

Log in to the HYCU VM console.

Review the "/etc/audit/auditd.conf" file and verify the settings are in accordance with a locally developed list of auditable events.

If it is not configured in accordance with organizational policies, this is a finding.

Check for the value of the "max_log_file_action" option in "/etc/audit/auditd.conf" with the following command: sudo grep max_log_file_action /etc/audit/auditd.conf

If the "max_log_file_action" value is not set to "ROTATE", this is a finding.

Configure the operating system to use a locally developed list of auditable events by editing "/etc/audit/auditd.conf" files using the following command: sudo vi /etc/audit/auditd.conf

Add or modify lines to have the required values for the organization.