V-286177

Discussion

Information system auditing capability is critical for accurate forensic analysis. Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events relating to an incident. In order to compile an accurate risk assessment and provide forensic analysis, it is essential for security personnel to know the date and time when events occurred. It is also essential for security personnel to know where events occurred, such as application components, modules, session identifiers, filenames, host names, and functionality. Associating the date, time, and location of the detected events in the application and audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured application. The application must also produce audit records that identify the application itself as the source of the event. Associating information about where the event and source occurred within the application provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured application. Database software is capable of a range of actions on data stored within the database. It is important for accurate forensic analysis, to know exactly when specific actions were performed. This requires the date and time an audit record is referring to. If date and time information is not recorded and stored with the audit record, the record itself is of very limited use. Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility for the potentially harmful event. Identifiers (if authenticated or otherwise known) include, but are not limited to, user database tables, primary key values, usernames, or process identifiers. Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the system. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the information system after the event occurred). As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Satisfies: SRG-APP-000095-DB-000039, SRG-APP-000096-DB-000040, SRG-APP-000097-DB-000041, SRG-APP-000098-DB-000042, SRG-APP-000099-DB-000043, SRG-APP-000100-DB-000201

Check Content

Verify the MariaDB Enterprise audit plugin is enabled and generating audit records containing the required audit information.

Verify the audit plugin is installed and active:

SHOW PLUGINS;

Verify audit logging is enabled:

SHOW GLOBAL VARIABLES LIKE 'server_audit_logging';

Review the configured audit log output location:

SHOW GLOBAL VARIABLES LIKE 'server_audit_file_path';

Review sample audit log records and verify the audit logs contain the following information for audited events:
- Timestamp.
- Server host.
- Username.
- Client host.
- Connection identifier.
- Query identifier.
- Operation performed.
- Database name.
- Object name.
- Return code/status.

Example:
tail -n 20 /path/to/server_audit.log

Example audit record content:
20260508 10:15:42,dbserver01,admin,10.0.0.10,12345,67890,QUERY,testdb,test_table,0

If audit records do not contain the required audit event content, this is a finding.