documentation_complete: true

title: 'Install Intrusion Detection Software'

description: |-
    The base Red Hat platform already includes a sophisticated auditing system that
    can detect intruder activity, as well as SELinux, which provides host-based
    intrusion prevention capabilities by confining privileged programs and user
    sessions which may become compromised.<br />
    In DoD environments, supplemental intrusion detection tools, such as, the McAfee
    Host-based Security System, are available to integrate with existing infrastructure.
    When these supplemental tools interfere with the proper functioning of SELinux, SELinux
    takes precedence.
    <br />

rationale: |-
    Host-based intrusion detection tools provide a system-level defense when an
    intruder gains access to a system or network.

severity: medium

identifiers:
    cce: 27409-2

references:
    disa: 1263
    nist: SC-7
    pcidss: Req-11.4
    srg: SRG-OS-000196
    stigid: RHEL-06-000285

ocil_clause: 'no host-based intrusion detection tools are installed'

ocil: "Inspect the system to determine if intrusion detection software has been installed. \nVerify this intrusion detection software is active."
