# Ensure events that modify the system's network environment are collected

Necessity: Auditing modifications to the system's network environment is crucial for detecting unauthorized changes that could indicate a security breach. An attacker might alter the hostname, domain name, or hosts file to impersonate other systems, redirect network traffic for man-in-the-middle attacks, or disrupt network services. Without logging these events, such malicious activities could go unnoticed, hindering incident response and forensic analysis. 

Auditing and Remediation: The audit script inspects the currently active auditd ruleset to verify that specific syscalls (`sethostname`, `setdomainname`) and critical network configuration files are being monitored for changes. The remediation script ensures these rules are written to a persistent configuration file within `/etc/audit/rules.d/` and reloads the auditd service to apply them, providing a durable audit trail. 

Recommended State Rationale: 
Basic: ['Configured'] - This is the essential state. Implementing these audit rules is a foundational security practice recommended by benchmarks like CIS. It ensures a baseline of visibility into critical system changes.
Moderate: ['Configured'] - The moderate state is the same as basic because this is a binary control; the rules are either present and effective or they are not. There is no intermediate level of compliance for this specific security requirement.
Strict: ['Configured'] - For a strict security posture, having these rules configured is non-negotiable. The specified rules are comprehensive for this control, covering both 32-bit and 64-bit architectures and all relevant configuration files. There is no 'stricter' version of this specific rule set.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Configured']` |
| **Moderate** | `['Configured']` |
| **Strict** | `['Configured']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the auditd rules for monitoring network environment modifications are correctly configured. The script should query the currently loaded audit rules (`auditctl -l`) and verify the presence of rules for the `sethostname` and `setdomainname` syscalls, as well as file watches (-w) on `/etc/issue`, `/etc/issue.net`, `/etc/hosts`, and `/etc/sysconfig/network`. The script must return only 'true' if all required rules are present or 'false' if one or more are missing.

## Remediation Script Working

Bash script that accepts one argument, 'Configured', to ensure the required auditd rules are active and persistent. If the argument is 'Configured', the script must add the following rules to a file in `/etc/audit/rules.d/`: ` -a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale`, `-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale`, `-w /etc/issue -p wa -k system-locale`, `-w /etc/issue.net -p wa -k system-locale`, `-w /etc/hosts -p wa -k system-locale`, and `-w /etc/sysconfig/network -p wa -k system-locale`. The script should then regenerate the master rule file and reload the auditd service. The script must return 'true' on success and 'false' on failure.

