# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low






- name: Record Events that Modify the System's Network Environment - /etc/issue - Check if watch rule for /etc/issue already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: "/etc/audit/rules.d"

    contains: '^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+'

    patterns: "*.rules"
  register: find_existing_watch_rules_d

- name: Record Events that Modify the System's Network Environment - /etc/issue - Search /etc/audit/rules.d for other rules with specified key system-locale
  ansible.builtin.find:
    paths: "/etc/audit/rules.d"
    contains: '^.*(?:-F key=|-k\s+)system-locale$'
    patterns: "*.rules"
  register: find_watch_key
  when: find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched == 0

- name: Record Events that Modify the System's Network Environment - /etc/issue - Use /etc/audit/rules.d/system-locale.rules as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
      - /etc/audit/rules.d/system-locale.rules
  when: find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched == 0

- name: Record Events that Modify the System's Network Environment - /etc/issue - Use matched file as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
      - "{{ find_watch_key.files | map(attribute='path') | list | first }}"
  when: find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched == 0

- name: Record Events that Modify the System's Network Environment - /etc/issue - Add watch rule for /etc/issue in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: "{{ all_files[0] }}"

    line: "-w /etc/issue -p wa -k system-locale"

    create: yes
    mode: '0600'
  when: find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched == 0
- name: Record Events that Modify the System's Network Environment - /etc/issue - Check if watch rule for /etc/issue already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: "/etc/audit/"

    contains: '^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+'

    patterns: "audit.rules"
  register: find_existing_watch_audit_rules

- name: Record Events that Modify the System's Network Environment - /etc/issue - Add watch rule for /etc/issue in /etc/audit/audit.rules
  ansible.builtin.lineinfile:

    line: "-w /etc/issue -p wa -k system-locale"

    state: present
    dest: /etc/audit/audit.rules
    create: yes
    mode: '0600'
  when: find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched == 0
