Documentation - V-279334

Title

MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.

Description

<VulnDiscussion>Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the DBMS (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of t...

Fix Text (Documentation Requirement)

Edit the MongoDB configuration file (default location /etc/mongod.conf) and add a configured "auditLog" setting: auditLog: destination: file format: BSON path: <mongodb audit log directory>/auditLog.bson -OR- auditLog: destination: syslog Add the following entry to the MongoDB configuration file: setParameter: auditAuthorizationSuccess: true Restart the MongoDB service from the OS. $ sudo systemctl restart mongod Setting of auditAuthorizationSuccess enables auditing of authorization success for the authCheck action. The parameter value must be true to audit read and write operations. However, when auditAuthorizationSuccess is false, auditing has less performance impact because the audit system only logs authorization failures. If the "auditLog" setting was...