Seeking Input - CCI-001488 - What do do when audit fails?

Shawn Wells shawn at redhat.com
Thu Apr 26 03:49:31 UTC 2012


(apologies if this is a dupe, received a bounce on my original posting)


CCI-001488 requires that we do something when the auditd system fails. 
Right now we have no rules for that.

For Red Hat's LSPP profiles we set failure mode to panic. Thoughts? 
Objections?

-Shawn


More information about the scap-security-guide mailing list