diff --git a/src/metaschema/examples/rules-ssp.xml b/src/metaschema/examples/rules-ssp.xml index 701e229ae2..e48bf5baf2 100644 --- a/src/metaschema/examples/rules-ssp.xml +++ b/src/metaschema/examples/rules-ssp.xml @@ -43,6 +43,14 @@ fips-199-moderate + + +

There is no authorization boundary for the application.

+ + +

This is a notional example that will be permenantely in a development state. No authorization boundary will be defined.

+ + @@ -53,14 +61,59 @@ maintain deploy system in environment - - - + + Monitoring System Logging for Indicators of Compromise Commands in Privileged Contacts + +

When threat actors want to confirm they have successfully performed privilege escalation, they will want to confirm they have elevated system privileges.

+

Responsible staff for a given role must monitor systems logs in a centralized logging system to confirm organizationally-recommended commands have not been run in a privileged context.

+
    +
  • whoami
    • +
  • id
    • +
  • groups
    • +
  • env
    • +
+ + + + + + + + +

This test documents which Splunk commands you will run to look for commands associated with indicators of compromise.

+ + +

The internal structure of structuring and passing parameters of the query is yet to be determined.

+ + + + + - + Example System Core Component + +

This component documents Example System, an information system under development that makes use of automated system evaluation with rules.

+ + + + +

This is an example system to demonstrate the use of rules for auditing requirements.

+ + +

Example System follows the Risk Management Framework as defined in SP 800-37 and 800-53 for risk management, privacy, and security guidance.

+ + + + +

This describes how Example System requires system operators to perform a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system, or other system that is dedicated to that analysis.

+ + + + +