OpenControls Logo

STIG Viewer

STIGViewer Support

MarkLogic Server must initiate session auditing upon startup.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-220347ML09-00-000800SV-220347r960888_ruleCCI-001464medium
Description
Session auditing is used when a user's activities are under investigation. To ensure all activity is captured during the periods when session auditing is in use, it must be in operation for the entire time the DBMS is running.
STIGDate
MarkLogic Server v9 Security Technical Implementation Guide2024-09-04

Related Frameworks

1 mapping across 2 frameworks
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (29) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-10Non-repudiation
1.00
AU-12Audit Record Generation
1.00
AU-12(3)Changes by Authorized Individuals
1.00
AU-14(1)System Start-up
1.00
AU-14(2)Capture and Record Content
1.00
AU-3Content of Audit Records
1.00

+19 more (top 10 by confidence shown)

CCI1 mapping
CCI-001464
1.00

Details

Check Text (C-220347r960888_chk)

Check that MarkLogic session-level auditing and specific session audits are currently defined and session auditing is enabled; or if a third-party product is available for session auditing. Perform the check from the MarkLogic Server Admin Interface with a user that holds administrative-level privileges. 1. Click the Groups icon. 2. Click the group in which the configuration to check resides (e.g., Default). 3. Click the Auditing icon on the left tree menu. 4. Inspect the audit enabled field, a value of false means there is no auditing, this is a finding.

Fix Text (F-22051r401493_fix)

Configure MarkLogic session-level auditing, ensure specific session audits are currently defined, and enable session auditing or verify a third-party product is available for session auditing. Perform the fix from the MarkLogic Server Admin Interface with a user that holds administrative-level privileges. 1. Click the Groups icon. 2. Click the group in which the configuration to check resides (e.g., Default). 3. Click the Auditing icon on the left tree menu. 4. Set the audit enabled field to true.