# Ensure events that modify the system's network environment are collected

Necessity: Monitoring events that modify the system's network environment is critical for security and integrity. Unauthorized changes to hostnames, domain names, or network configuration files can be indicators of a system compromise, an attempt to impersonate another system, or an effort to redirect network traffic for malicious purposes (e.g., man-in-the-middle attacks). Collecting these events provides a crucial audit trail for forensic analysis and helps in the early detection of suspicious activity. Auditing and Remediation: The audit script inspects the currently loaded auditd rules to ensure that specific watches are in place for system calls like 'sethostname' and file access to '/etc/hosts', '/etc/network/', etc. The remediation script adds these prescribed rules to the auditd configuration files, ensuring they are persistent across reboots, and then reloads the audit service to apply them immediately. Recommended State Rationale: For this control, the state is binary; the rules are either configured or they are not. Therefore, 'Configured' is the only acceptable state across all security levels. Basic: Setting this control to 'Configured' establishes a fundamental baseline for system integrity monitoring as recommended by security benchmarks like CIS. Moderate: Upholds the same requirement as Basic, as there is no effective intermediate state. The monitoring is either active or it is not. Strict: In a high-security environment, comprehensive auditing is non-negotiable. This control must be 'Configured' to ensure any attempt to alter the system's network identity or configuration is logged for security information and event management (SIEM) systems and immediate investigation.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Configured']` |
| **Moderate** | `['Configured']` |
| **Strict** | `['Configured']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the auditd rules for monitoring system network environment modifications are correctly configured. The script should parse the output of `auditctl -l` to verify the presence of rules that watch the following system calls and files: `sethostname`, `setdomainname`, `/etc/issue`, `/etc/issue.net`, `/etc/hosts`, and `/etc/network/`. The script must return only 'true' if all required rules are present, and 'false' otherwise, with no extra text.

## Remediation Script Working

Bash script that accepts one argument: 'configured'. When executed, the script will create or append the necessary auditd rules to a persistent file (e.g., `/etc/audit/rules.d/50-network-config.rules`). The rules to be added are: `-w /etc/issue -p wa -k system-locale`, `-w /etc/issue.net -p wa -k system-locale`, `-w /etc/hosts -p wa -k system-locale`, `-w /etc/network/ -p wa -k system-locale`, `-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale`, and `-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale`. After writing the rules, it must load them into the active configuration, for instance by running `augenrules --load`. The script must return 'true' upon success or 'false' if it fails.

