DISA_STIG_MongoDB_Enterprise_Advanced_3.x_OS_v1r1.audit from DISA MongoDB Enterprise Advanced 3.x v2r1 STIG

MD3X-00-000010 - MongoDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

CAT|I

CCI|CCI-000015

Rule-ID|SV-221158r822434_rule

STIG-ID|MD3X-00-000010

STIG-Legacy|SV-96557

STIG-Legacy|V-81843

Vuln-ID|V-221158

MD3X-00-000040 - MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.

CAT|II

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000135

CCI|CCI-000140

CCI|CCI-000166

CCI|CCI-000171

CCI|CCI-000172

CCI|CCI-001462

CCI|CCI-001464

CCI|CCI-001487

CCI|CCI-001814

CCI|CCI-001844

CCI|CCI-001851

CCI|CCI-001858

Rule-ID|SV-221160r410976_rule

STIG-ID|MD3X-00-000040

STIG-Legacy|SV-96561

STIG-Legacy|V-81847

Vuln-ID|V-221160

MD3X-00-000190 - The audit information produced by MongoDB must be protected from unauthorized read access.

CCI|CCI-000162

CCI|CCI-000163

CCI|CCI-000164

Rule-ID|SV-221161r410979_rule

STIG-ID|MD3X-00-000190

STIG-Legacy|SV-96563

STIG-Legacy|V-81849

Vuln-ID|V-221161

MD3X-00-000220 - MongoDB must protect its audit features from unauthorized access.

CCI|CCI-001493

CCI|CCI-001494

CCI|CCI-001495

Rule-ID|SV-221162r410982_rule

STIG-ID|MD3X-00-000220

STIG-Legacy|SV-96565

STIG-Legacy|V-81851

Vuln-ID|V-221162

MD3X-00-000250 - MongoDB software installation account must be restricted to authorized users.

CCI|CCI-001499

Rule-ID|SV-221163r822436_rule

STIG-ID|MD3X-00-000250

STIG-Legacy|SV-96567

STIG-Legacy|V-81853

Vuln-ID|V-221163

MD3X-00-000260 - Database software, including DBMS configuration files, must be stored in dedicated directories, or DASD pools, separate from the host OS and other applications.

Rule-ID|SV-221164r410988_rule

STIG-ID|MD3X-00-000260

STIG-Legacy|SV-96569

STIG-Legacy|V-81855

Vuln-ID|V-221164

MD3X-00-000280 - Unused database components, DBMS software, and database objects must be removed.

CCI|CCI-000381

Rule-ID|SV-221166r410994_rule

STIG-ID|MD3X-00-000280

STIG-Legacy|SV-96573

STIG-Legacy|V-81859

Vuln-ID|V-221166

MD3X-00-000290 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled - enabled

CCI|CCI-000382

Rule-ID|SV-221167r410997_rule

STIG-ID|MD3X-00-000290

STIG-Legacy|SV-96575

STIG-Legacy|V-81861

Vuln-ID|V-221167

MD3X-00-000290 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled - JSONPEnabled

MD3X-00-000290 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled - RESTInterfaceEnabled

MD3X-00-000310 - MongoDB must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

CCI|CCI-000764

Rule-ID|SV-221168r411000_rule

STIG-ID|MD3X-00-000310

STIG-Legacy|SV-96577

STIG-Legacy|V-81863

Vuln-ID|V-221168

MD3X-00-000320 - If DBMS authentication using passwords is employed, MongoDB must enforce the DoD standards for password complexity and lifetime.

CCI|CCI-000192

Rule-ID|SV-221169r822437_rule

STIG-ID|MD3X-00-000320

STIG-Legacy|SV-96579

STIG-Legacy|V-81865

Vuln-ID|V-221169

MD3X-00-000330 - If passwords are used for authentication, MongoDB must store only hashed, salted representations of passwords.

CCI|CCI-000196

Rule-ID|SV-221170r822438_rule

STIG-ID|MD3X-00-000330

STIG-Legacy|SV-96581

STIG-Legacy|V-81867

Vuln-ID|V-221170

MD3X-00-000340 - If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords - allowInvalidCertificates

CCI|CCI-000185

CCI|CCI-000197

Rule-ID|SV-221171r822440_rule

STIG-ID|MD3X-00-000340

STIG-Legacy|SV-96583

STIG-Legacy|V-81869

Vuln-ID|V-221171

MD3X-00-000340 - If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords - CAFile

MD3X-00-000340 - If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords - mode

MD3X-00-000340 - If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords - PEMKeyFile

MD3X-00-000360 - MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB - CAFile

CCI|CCI-000186

Rule-ID|SV-221172r457869_rule

STIG-ID|MD3X-00-000360

STIG-Legacy|SV-96585

STIG-Legacy|V-81871

Vuln-ID|V-221172

MD3X-00-000360 - MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB - PEMKeyFile

MD3X-00-000380 - MongoDB must use NIST FIPS 140-2-validated cryptographic modules for cryptographic operations.

CCI|CCI-000803

CCI|CCI-002450

Rule-ID|SV-221174r411018_rule

STIG-ID|MD3X-00-000380

STIG-Legacy|SV-96589

STIG-Legacy|V-81875

Vuln-ID|V-221174

MD3X-00-000410 - MongoDB must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.

CCI|CCI-001188

Rule-ID|SV-221176r411024_rule

STIG-ID|MD3X-00-000410

STIG-Legacy|SV-96593

STIG-Legacy|V-81879

Vuln-ID|V-221176

MD3X-00-000420 - MongoDB must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.

CCI|CCI-001190

CCI|CCI-001665

Rule-ID|SV-221177r411027_rule

STIG-ID|MD3X-00-000420

STIG-Legacy|SV-96595

STIG-Legacy|V-81881

Vuln-ID|V-221177

MD3X-00-000440 - MongoDB must protect the confidentiality and integrity of all information at rest.

CCI|CCI-001199

Rule-ID|SV-221178r822441_rule

STIG-ID|MD3X-00-000440

STIG-Legacy|SV-96597

STIG-Legacy|V-81883

Vuln-ID|V-221178

MD3X-00-000460 - Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.

CCI|CCI-001090

Rule-ID|SV-221179r411033_rule

STIG-ID|MD3X-00-000460

STIG-Legacy|SV-96599

STIG-Legacy|V-81885

Vuln-ID|V-221179

MD3X-00-000470 - MongoDB must prevent unauthorized and unintended information transfer via shared system resources - .conf file

Rule-ID|SV-221180r411036_rule

STIG-ID|MD3X-00-000470

STIG-Legacy|SV-96601

STIG-Legacy|V-81887

Vuln-ID|V-221180

MD3X-00-000470 - MongoDB must prevent unauthorized and unintended information transfer via shared system resources - Data Dir

MD3X-00-000490 - MongoDB must check the validity of all data inputs except those specifically identified by the organization.

CCI|CCI-001310

Rule-ID|SV-221181r411039_rule

STIG-ID|MD3X-00-000490

STIG-Legacy|SV-96603

STIG-Legacy|V-81889

Vuln-ID|V-221181

MD3X-00-000500 - MongoDB and associated applications must reserve the use of dynamic code execution for situations that require it.

Rule-ID|SV-221182r411042_rule

STIG-ID|MD3X-00-000500

STIG-Legacy|SV-96605

STIG-Legacy|V-81891

Vuln-ID|V-221182

MD3X-00-000520 - MongoDB must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

CCI|CCI-001312

Rule-ID|SV-221183r411045_rule

STIG-ID|MD3X-00-000520

STIG-Legacy|SV-96607

STIG-Legacy|V-81893

Vuln-ID|V-221183

MD3X-00-000530 - MongoDB must reveal detailed error messages only to the ISSO, ISSM, SA, and DBA.

CCI|CCI-001314

Rule-ID|SV-221184r411048_rule

STIG-ID|MD3X-00-000530

STIG-Legacy|SV-96609

STIG-Legacy|V-81895

Vuln-ID|V-221184

MD3X-00-000600 - MongoDB must utilize centralized management of the content captured in audit records generated by all components of MongoDB.

Rule-ID|SV-221188r411060_rule

STIG-ID|MD3X-00-000600

STIG-Legacy|SV-96617

STIG-Legacy|V-81903

Vuln-ID|V-221188

MD3X-00-000620 - MongoDB must allocate audit record storage capacity in accordance with site audit record storage requirements.

CCI|CCI-001849

Rule-ID|SV-221189r411063_rule

STIG-ID|MD3X-00-000620

Detections

Analytics

DISA STIG MongoDB Enterprise Advanced 3.x v2r1 OS

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.7

Miscellaneous

Revision 1.6

Miscellaneous

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Added

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.7 Jun 17, 2024 Miscellaneous Metadata updated.
Revision 1.6 May 15, 2024 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.5 Dec 6, 2023 Miscellaneous Metadata updated. Platform check updated. References updated. Variables updated.
Revision 1.4 Apr 12, 2023 Miscellaneous Metadata updated. Platform check updated. Added DISA_STIG_MongoDB_Enterprise_Advanced_3.x_OS_v1r1.audit from DISA MongoDB Enterprise Advanced 3.x v2r1 STIG
Revision 1.3 Mar 7, 2023 Miscellaneous Metadata updated. References updated. Variables updated.
Revision 1.2 Dec 7, 2022 Miscellaneous Metadata updated.
Revision 1.1 Jun 3, 2022 Miscellaneous Metadata updated.