Check Types

The syntax for the VMware .audit capability relies heavily on XPATH and XSL Transforms to perform the functionality.

The VMware audit supports three types of checks:

AUDIT_VM

This check type allows you to audit virtual machine settings (see Appendix C for more information):

<custom_item>

type: AUDIT_VM

description: "VM Setting - 'vmsafe.enable = False'"

xsl_stmt: "<xsl:template match=\"audit:returnval\">"

xsl_stmt: "<xsl:value-of select=\"audit:propSet/audit:val[@xsi:type='VirtualMachineConfigInfo']/audit:name\"/> : vmsafe.enable : <xsl:value-of select=\"audit:propSet/audit:val[@xsi:type='VirtualMachineConfigInfo']/audit:extraConfig[audit:key[text()='vmsafe.enable']]/audit:value\"/>."

xsl_stmt: "</xsl:template>"

expect: "vmsafe.enable : 0"

</custom_item>

AUDIT_ESX

This check type allows you to audit ESX/ESXi server settings:

<custom_item>

type: AUDIT_ESX

description : "ESX/ESXi Setting - Syslog.global.logDir"

xsl_stmt: "<xsl:template match=\"audit:returnval\">"

xsl_stmt: "Syslog.global.logDir = <xsl:value-of select=\"audit:propSet/audit:val[@xsi:type='HostConfigInfo']/audit:option[audit:key[text()='Syslog.global.logDir']]/audit:value\"/>"

xsl_stmt: "</xsl:template>"

expect: "Syslog.global.logDir : /foo/bar"

</custom_item>

AUDIT_VCENTER

This check type allows you to audit vCenter settings:

<custom_item>

type: AUDIT_VCENTER

description: "VMware vCenter Setting - config.vpxd.hostPasswordLength"

xsl_stmt: "<xsl:template match=\"audit:returnval\">"

xsl_stmt: "config.vpxd.hostPasswordLength = <xsl:value-of select=\"audit:propSet/audit:val[@xsi:type='ArrayOfOptionValue']/audit:OptionValue[audit:key[text()='config.vpxd.hostPasswordLength']]/audit:value\"/>"

xsl_stmt: "</xsl:template>"

expect: "config.vpxd.hostPasswordLength : 30"

</custom_item>

Copyright © 2019 Tenable, Inc. All rights reserved. Tenable, Tenable.io, Tenable Network Security, Nessus, SecurityCenter, SecurityCenter Continuous View and Log Correlation Engine are registered trademarks of Tenable, Inc.. Tenable.sc, Lumin, Assure, and the Cyber Exposure Company are trademarks of Tenable, Inc. All other products or services are trademarks of their respective owners.