STIGQter: STIG Summary: vRealize - Cassandra Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 05 Jun 2017:

The Cassandra Server must utilize centralized management of the content captured in audit records generated by all components of the system.

DISA Rule

SV-87305r1_rule

Vulnerability Number

V-72673

Group Title

SRG-APP-000356-DB-000314

Rule Version

VROM-CS-000210

Severity

CAT II

CCI(s)

• CCI-001844 - The information system provides centralized management and configuration of the content to be captured in audit records generated by organization-defined information system components.

Weight

10

Fix Recommendation

Configure the Cassandra Server to utilize centralized management of the content captured in audit records generated by all components of the system.

Navigate to and open /usr/lib/vmware-vcops/user/conf/cassandra/logback.xml.

Navigate to the <configuration> node.

Add the following <appender> node to the <configuration> node.

<appender name="SYSLOG" class="ch.qos.logback.classic.net.SyslogAppender">
<syslogHost>syslogServerHostName</syslogHost>
<facility>AUTH</facility>
<suffixPattern>%-5level [%thread] %date{ISO8601, UTC} %F:%L - %msg%n </suffixPattern>
</appender>

Navigate to the <root> node.

Add the following to the <root> node.
<appender-ref ref="SYSLOG" />

Check Contents

Review the Cassandra Server settings to ensure centralized management of the content captured in audit records generated by all components of the system are utilized.

At the command prompt, execute the following command:

# grep SyslogAppender /usr/lib/vmware-vcops/user/conf/cassandra/logback.xml

If level is not set to "ALL", this is a finding.

Vulnerability Number

V-72673

Documentable

False

Rule Version

VROM-CS-000210

Severity Override Guidance

Review the Cassandra Server settings to ensure centralized management of the content captured in audit records generated by all components of the system are utilized.

At the command prompt, execute the following command:

# grep SyslogAppender /usr/lib/vmware-vcops/user/conf/cassandra/logback.xml

If level is not set to "ALL", this is a finding.

Check Content Reference

M

Target Key

3179

Comments