STIGQter: STIG Summary: vRealize - Cassandra Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 05 Jun 2017:

The Cassandra database must produce audit records containing sufficient information to establish what type of events occurred.

DISA Rule

SV-87265r1_rule

Vulnerability Number

V-72633

Group Title

SRG-APP-000095-DB-000039

Rule Version

VROM-CS-000040

Severity

CAT II

CCI(s)

• CCI-000130 - The information system generates audit records containing information that establishes what type of event occurred.

Weight

10

Fix Recommendation

Configure the Cassandra Server to produce audit records containing sufficient information to establish what type of events occurred.

Navigate to and open /usr/lib/vmware-vcops/user/conf/cassandra/logback.xml.

Navigate to the <appender> node with the name="FILE" attribute.

Navigate to <encoder> node.

Edit the <pattern> to look like the below.
<pattern>%-5level [%thread] %date{ISO8601, UTC} %F:%L - %msg%n</pattern>

Check Contents

Review the Cassandra Server settings to ensure audit records containing sufficient information to establish what type of events occurred are produced.

Navigate to and open /usr/lib/vmware-vcops/user/conf/cassandra/logback.xml.

Navigate to the <appender> node with the name="FILE" attribute.

Navigate to <encoder> node.

If the <pattern> node does not look like the expected result, this is a finding.

Expected result:
<pattern>%-5level [%thread] %date{ISO8601, UTC} %F:%L - %msg%n</pattern>

Vulnerability Number

V-72633

Documentable

False

Rule Version

VROM-CS-000040

Severity Override Guidance

Review the Cassandra Server settings to ensure audit records containing sufficient information to establish what type of events occurred are produced.

Navigate to and open /usr/lib/vmware-vcops/user/conf/cassandra/logback.xml.

Navigate to the <appender> node with the name="FILE" attribute.

Navigate to <encoder> node.

If the <pattern> node does not look like the expected result, this is a finding.

Expected result:
<pattern>%-5level [%thread] %date{ISO8601, UTC} %F:%L - %msg%n</pattern>

Check Content Reference

M

Target Key

3179

Comments