4.1.3 Ensure auditing for processes that start prior to auditd is enabled - /etc/default/grub
Information
Audit events need to be captured on processes that start up prior to auditd, so that potential malicious activity cannot go undetected.
Solution
For grub2 based systems edit /etc/default/grub and add audit=1 to GRUB_CMDLINE_LINUX: GRUB_CMDLINE_LINUX='audit=1' Run the following command to update the grub2 configuration: # update-grub