documentation_complete: true

prodtype: rhel7,fedora

title: 'Enable auditd Service'

description: |-
    The <tt>auditd</tt> service is an essential userspace component of
    the Linux Auditing System, as it is responsible for writing audit records to
    disk.
    <systemd-service-macro enable="true" service="auditd" />

rationale: |-
    Without establishing what type of events occurred, it would be difficult
    to establish, correlate, and investigate the events leading up to an outage or attack.
    Ensuring the <tt>auditd</tt> service is active ensures audit records
    generated by the kernel are appropriately recorded.
    <br /><br />
    Additionally, a properly configured audit subsystem ensures that actions of
    individual system users can be uniquely traced to those users so they
    can be held accountable for their actions.

severity: high

identifiers:
    cce@rhel7: 27407-6

references:
    cis: 4.1.2
    cjis: 5.4.1.1
    cui: 3.3.1,3.3.2,3.3.6
    disa: 126,131
    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(5)(ii)(C),164.310(a)(2)(iv),164.310(d)(2)(iii),164.312(b)
    nist: AU-3,AC-17(1),AU-1(b),AU-10,AU-12(a),AU-12(c),AU-14(1),IR-5
    pcidss: Req-10
    srg: SRG-OS-000038-GPOS-00016,SRG-OS-000039-GPOS-00017,SRG-OS-000042-GPOS-00021,SRG-OS-000254-GPOS-00095,SRG-OS-000255-GPOS-00096
    stigid@rhel7: "030000"

ocil: '<systemd-check-macro enable="true" service="auditd" />'
