[PATCH 08/11] Mapped audit_file_deletions to CCI-000126

Shawn Wells shawn at redhat.com
Wed Jul 4 06:04:30 UTC 2012


Mapped to 126 to stay consistent with STIG mappings
---
 rhel6/src/input/system/auditing.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 63eb5c7..2ab0adf 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -662,7 +662,7 @@ from the system. The audit trail could aid in system troubleshooting as well as
 malicious processes that attempt to delete log files to conceal their presence.</rationale>
 <ident cce="14820-5" />
 <oval id="audit_rules_file_deletion_events" />
-<ref nist="AU-2" />
+<ref nist="AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_sysadmin_actions">
-- 
1.7.1


--cWoXeonUoKmBZSoM--


More information about the scap-security-guide mailing list