Feature: cisAudit
Description
A sub-feature of cis that installs and configures auditd per CIS benchmark requirements. Must be used with the cis feature.
What it does
Configures auditd logging of security events including date/time changes, sudo usage, and disk-space failure handling. Provides audit rules in /etc/audit/rules.d/99-cis.rules and a systemd service override to ensure audit rules are loaded correctly at boot.
Files
Files present in this feature and their purpose. See the feature file reference for the semantics of each file type.
| File | Purpose |
|---|---|
exec.config (ref) | Enables auditd and applies CIS audit configuration. |
file.include.markers.yaml (ref) | Maps files to test-coverage marker IDs. |
info.yaml (ref) | Declares type: element and included/excluded features. |
file.include/etc/audit/rules.d/99-cis.rules (file.include) | CIS benchmark audit rules covering date/time changes, sudo usage, and disk-space failure handling. |
file.include/etc/systemd/system/audit-rules.service.d/override.conf (file.include) | systemd override to ensure audit rules are loaded correctly after auditd starts. |
Related features
This feature has no include or exclude relationships.