OCP4 STIG: select rule for audit backlog limit

SRG-APP-000092-CTR-000165 is about setting 'audit' and 'audit_backlog_limit' options. Only one of them was being set.
a-skr · Feb 1, 2024 · 6c867ce · 6c867ce
1 parent 6f6a229
commit 6c867ce
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/controls/srg_ctr/SRG-APP-000092-CTR-000165.yml b/controls/srg_ctr/SRG-APP-000092-CTR-000165.yml
@@ -7,5 +7,6 @@ controls:
   - cluster_logging_operator_exist
   - audit_log_forwarding_enabled
   - coreos_audit_option
+  - coreos_audit_backlog_limit_kernel_argument
   status: automated
 
diff --git a/linux_os/guide/system/auditing/coreos_audit_backlog_limit_kernel_argument/rule.yml b/linux_os/guide/system/auditing/coreos_audit_backlog_limit_kernel_argument/rule.yml
@@ -23,7 +23,7 @@ identifiers:
 references:
     cis@rhel8: 4.1.1.4
     nist: CM-6(a)
-    srg: SRG-OS-000254-GPOS-00095
+    srg: SRG-OS-000254-GPOS-00095,SRG-APP-000092-CTR-000165
 
 ocil_clause: 'audit backlog limit is not configured'