If you are using Graylog (ELK Stack) you want to use Filebeat. Using rsyslog also to simply satisfy a test seems overkill.

We have many cases of this; for example (maybe not the best one) we run AIDE from a cron.daily/aide file that mails results.

And yes, while we fail the SCAP tests, we have defined alternate tests in our configuration that confirm proper operation.

As we build out component level verification for OpenControl, we are finding additional tests are needed, too.

I can see that this diverges from a clean "Red Hat Way" but sometimes systems are different - and perhaps more secure?

Sometimes compliance can be the enemy of security.

=Fen


On Tue, Jun 6, 2017 at 11:23 PM, Shawn Wells <shawn@redhat.com> wrote:


On 6/6/17 11:05 PM, Fen Labalme wrote:
> While rsyslog is an option, we use filebeat with SSL/TLS. Many ways to
> manage as you say. Testing and validation methods need to support
> tailoring.

IMHO it's scope creep to support every possible 3rd party solution.
OS-level config checks should be scoped to evaluated native OS-level
capabilities.

With that said, for things that are configured through 3rd party means,
how have you been getting by? Addendum to certification test plans?
_______________________________________________
scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org
To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org