← Back to Red Hat Enterprise Linux 10 Security Technical Implementation Guide

V-280995

CAT III (Low)

RHEL 10 must have the "audispd-plugins" package installed.

Rule ID

SV-280995r1195383_rule

STIG

Red Hat Enterprise Linux 10 Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-001851

Discussion

The "audispd-plugins" package provides plugins for the real-time interface to the audit subsystem, "audispd". These plugins can do such things as relay events to remote machines or analyze events for suspicious behavior.

Check Content

Verify RHEL 10 has the "audispd-plugins" package installed with the following command:

$ sudo dnf list --installed audispd-plugins
Installed Packages
audispd-plugins.x86_64                           4.0.3-1.el10                            @rhel-10-for-x86_64-baseos-rpms

If the "audispd-plugins" package is not installed, this is a finding.

Fix Text

Configure RHEL 10 to have the "audispd-plugins" package installed with the following command:

$ sudo dnf -y install audispd-plugins