[PATCH 10/33] Mapped CCI-001263 to aide_periodic_cron_checking.
Shawn Wells
shawn at redhat.com
Thu Jul 5 21:05:12 UTC 2012
On 7/5/12 4:52 PM, Willy Santos wrote:
> CCI-001263 requires providing a near real-time alert when any of the org-defined list of potential compromise indicators occur. AIDE can be used for this purpose.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
> rhel6/src/input/system/software/integrity.xml | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/system/software/integrity.xml b/rhel6/src/input/system/software/integrity.xml
> index e882032..12d70fa 100644
> --- a/rhel6/src/input/system/software/integrity.xml
> +++ b/rhel6/src/input/system/software/integrity.xml
> @@ -93,7 +93,7 @@ AIDE can be executed periodically through other means; this is merely one exampl
> By default, AIDE does not install itself for periodic execution. Periodically
> running AIDE may reveal unexpected changes in installed files.
> </rationale>
> -<ref nist="CM-6, SC-28, SI-7" disa="416,1166"/>
> +<ref nist="CM-6, SC-28, SI-7" disa="416,1166,1263"/>
> </Rule>
>
> <Rule id="aide_verify_integrity_manually">
I'd map this back to the auditing section too.
More information about the scap-security-guide
mailing list