On Tuesday, February 28, 2012 08:16:12 PM Shawn Wells wrote:
I'd like to see the audit -k field names match whatever we call
the
actual check.
As they currently are, they describe the exact STIG requirement they fulfill.
There is a comment above the rule and you should be able to correlate the key
with the comment in every case. The purpose of the keys is so that this makes
sense:
aureport --start today --key --summary
This is the first step in any investigation. What policy violations do I
currently have?
Right now they're (fairly arbitrary) strings from the stig.rules
file. Any
objection to changing them to match the rule name?
Yeah. I object. What would be the proposed change? How would it make the key
report any more useful than it currently is?
-Steve