From 14256eb9fb7e8fa3fb2ace1477d497b94925d4da Mon Sep 17 00:00:00 2001
From: teacup-on-rockingchair
 <315160+teacup-on-rockingchair@users.noreply.github.com>
Date: Mon, 14 Sep 2026 15:08:25 +0300
Subject: [PATCH 1/5] xattrs is removed for sle16/opensuse16 since AIDE does
 not support it, aide_verify_ext_attributes rule is disabled also

---
 .../aide/aide_check_audit_tools/oval/shared.xml             | 4 ++++
 .../aide/aide_check_audit_tools/tests/correct.pass.sh       | 6 +++++-
 .../aide/aide_check_audit_tools/tests/extra_suffix.fail.sh  | 6 +++++-
 shared/macros/01-general.jinja                              | 4 ++++
 4 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml
index 13e9e377e316..411874fe751b 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml
@@ -11,7 +11,11 @@
 
   <ind:textfilecontent54_state id="state_aide_check_attributes" version="1">
     {{% if 'rhel' not in product and 'ubuntu' not in product and 'ol' not in families and 'fedora' not in product %}}
+    {{% if product in ['sle16'] %}}
+    <ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+sha512</ind:subexpression>
+    {{% else %}}
     <ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+xattrs+sha512</ind:subexpression>
+    {{% endif %}}
     {{% else %}}
     <ind:subexpression operation="pattern match">^p\+i\+n\+u\+g\+s\+b\+acl(|\+selinux)\+xattrs\+sha512$</ind:subexpression>
     {{% endif %}}
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh
index 7795e143b54a..db6c7ee6567c 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
 # packages = aide
 
 aide --init
@@ -14,5 +14,9 @@ bins=(
 echo >> {{{ aide_conf_path }}}
 for theFile in "${bins[@]}"
 do
+    {{% if product in ['sle16'] %}}
+    echo "$theFile p+i+n+u+g+s+b+acl+sha512"  >> {{{ aide_conf_path }}}
+    {{% else %}}
     echo "$theFile p+i+n+u+g+s+b+acl+xattrs+sha512"  >> {{{ aide_conf_path }}}
+    {{% endif %}}
 done
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/extra_suffix.fail.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/extra_suffix.fail.sh
index dc664133e207..b2f4b95a65b2 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/extra_suffix.fail.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/extra_suffix.fail.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
 # packages = aide
 
 declare -a bins
@@ -11,5 +11,9 @@ bins=(
 
 for theFile in "${bins[@]}"
 do
+    {{% if product in ['sle16'] %}}
+    echo "$theFile p+i+n+u+g+s+b+acl+selinux+sha5122" >> {{{ aide_conf_path }}}
+    {{% else %}}
     echo "$theFile p+i+n+u+g+s+b+acl+selinux+xattrs+sha5122" >> {{{ aide_conf_path }}}
+    {{% endif %}}
 done
diff --git a/shared/macros/01-general.jinja b/shared/macros/01-general.jinja
index 8166bc149381..46066b6d7618 100644
--- a/shared/macros/01-general.jinja
+++ b/shared/macros/01-general.jinja
@@ -1250,7 +1250,11 @@ For more details on configuring kernel arguments in bootable container images, p
 #}}
 {{%- macro aide_string() -%}}
 {{%- if 'rhel' not in product and 'ubuntu' not in product and 'ol' not in families and product not in ['fedora'] -%}}
+{{%- if product in ['sle16'] -%}}
+p+i+n+u+g+s+b+acl+selinux+sha512
+{{%- else -%}}
 p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
+{{%- endif -%}}
 {{%- else -%}}
 p+i+n+u+g+s+b+acl+xattrs+sha512
 {{%- endif -%}}

From b7f9789a71d724eeb2f087a66b489103111ac221 Mon Sep 17 00:00:00 2001
From: teacup-on-rockingchair
 <315160+teacup-on-rockingchair@users.noreply.github.com>
Date: Mon, 14 Sep 2026 15:13:07 +0300
Subject: [PATCH 2/5] AIDE patch: all SUSE platforms use

aide.service for checking aide DB
aide.timer for triggering aide.service
aidecheck-notify.service sending /var/log/aide-report.log to configured mail
---
 .../tests/correct_with_selinux.pass.sh        |  6 +-
 .../tests/expect_sbin_path.pass.sh            |  6 +-
 .../tests/not_config.fail.sh                  |  2 +-
 .../ansible/shared.yml                        | 54 +++++++----
 .../bash/shared.sh                            | 35 ++++---
 .../oval/shared.xml                           | 16 ++--
 .../tests/aide_timer_weekly.pass.sh           | 21 ++--
 .../aide_scan_notification/ansible/shared.yml | 96 +++++++++++++++----
 .../aide_scan_notification/bash/shared.sh     | 59 ++++++++----
 .../aide_scan_notification/oval/shared.xml    | 31 ++++--
 .../aide/aide_scan_notification/rule.yml      | 10 +-
 .../aide/aide_use_fips_hashes/bash/shared.sh  |  2 +-
 .../tests/correct_value.pass.sh               |  3 +-
 .../tests/correct_value_inline.pass.sh        |  3 +-
 .../tests/wrong_value.fail.sh                 |  2 +-
 .../tests/wrong_value_inline.fail.sh          |  2 +-
 .../file_audit_tools_group_ownership/rule.yml |  7 +-
 .../aide/file_audit_tools_ownership/rule.yml  |  6 +-
 .../file_audit_tools_permissions/rule.yml     |  6 +-
 19 files changed, 266 insertions(+), 101 deletions(-)

diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh
index 5a9f67915568..522cf2e3dc77 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
 # packages = aide
 
 declare -a bins
@@ -12,5 +12,9 @@ bins=(
 echo >> {{{ aide_conf_path }}}
 for theFile in "${bins[@]}"
 do
+    {{% if product in ['sle16'] %}}
+    echo "$theFile p+i+n+u+g+s+b+acl+selinux+sha512"  >> {{{ aide_conf_path }}}
+    {{% else %}}
     echo "$theFile p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> {{{ aide_conf_path }}}
+    {{% endif %}}
 done
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/expect_sbin_path.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/expect_sbin_path.pass.sh
index f3a768e16b61..5730366c3b85 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/expect_sbin_path.pass.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/expect_sbin_path.pass.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
 # packages = aide
 
 declare -a bins
@@ -12,5 +12,9 @@ bins=(
 echo >> {{{ aide_conf_path }}}
 for theFile in "${bins[@]}"
 do
+    {{% if product in ['sle16'] %}}
+    echo "$theFile p+i+n+u+g+s+b+acl+sha512"  >> {{{ aide_conf_path }}}
+    {{% else %}}
     echo "$theFile p+i+n+u+g+s+b+acl+xattrs+sha512"  >> {{{ aide_conf_path }}}
+    {{% endif %}}
 done
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh
index 026e5b3ed037..f340db561154 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_sle,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu
 # packages = aide
 
 aide --init
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/shared.yml
index 36a76ba9f388..5c7d035a78bb 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/shared.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/shared.yml
@@ -4,14 +4,32 @@
 # complexity = low
 # disruption = low
 
-- name: "{{{ rule_title }}} - Define AIDE Periodic Check Service"
-  ansible.builtin.blockinfile:
-      create: yes
-      dest: /etc/systemd/system/aidecheck.service
+{{% set aide_service = 'aide.service' %}}
+{{% set aide_timer = 'aide.timer' %}}
+
+{{% if product in ["sle16"] %}}
+- name: "{{{ rule_title }}} - Make sure AIDE Check Service is including /etc/aide.conf"
+  ansible.builtin.copy:
+      dest: /etc/aide_service.conf
+      owner: root
+      group: root
+      mode: 0600
+      content: |-
+        "@@include /etc/aide.conf"
+
+- name: "{{{ rule_title }}} - Make sure AIDE Check Service is in enabled state"
+  ansible.builtin.file:
+    src: /usr/lib/systemd/system/{{{ aide_service }}}
+    path: /etc/systemd/system/multi-user.target.wants/{{{ aide_service }}}
+    state: link
+{{% else %}}
+- name: "{{{ rule_title }}} - Define AIDE Periodic Check Service {{{ aide_service }}}"
+  ansible.builtin.copy:
+      dest: /etc/systemd/system/{{{ aide_service }}}
       owner: root
       group: root
-      mode: '0644'
-      block: |
+      mode: 0644
+      content: |-
         [Unit]
         Description=Aide Check
         [Service]
@@ -20,35 +38,35 @@
         [Install]
         WantedBy=multi-user.target
 
-- name: "{{{ rule_title }}} - Define AIDE Periodic Check Service Timer"
-  ansible.builtin.blockinfile:
-      create: yes
-      dest: /etc/systemd/system/aidecheck.timer
+- name: "{{{ rule_title }}} - Define AIDE Periodic Check Service Timer {{{ aide_timer }}}"
+  ansible.builtin.copy:
+      dest: /etc/systemd/system/{{{ aide_timer }}}
       owner: root
       group: root
-      mode: '0644'
-      block: |
+      mode: 0644
+      content: |-
         [Unit]
         Description=Aide check every day at 5AM
         [Timer]
         OnCalendar=*-*-* 05:00:00
-        Unit=aidecheck.service
+        Unit={{{ aide_service }}}
         [Install]
         WantedBy=multi-user.target
 
-- name: "{{{ rule_title }}} - Ensure AIDE Service is Enabled"
+{{% endif %}}
+- name: "{{{ rule_title }}} - Ensure AIDE Service {{{ aide_service }}} is enabled"
   ansible.builtin.systemd:
-    name: aidecheck.service
+    name: {{{ aide_service }}}
     enabled: true
     daemon_reload: true
     masked: false
   when: not ansible_check_mode
 
-- name: "{{{ rule_title }}} - Ensure AIDE Service Timer is Enabled"
+- name: "{{{ rule_title }}} - Ensure AIDE Service Timer {{{ aide_timer }}} is enabled"
   ansible.builtin.systemd:
-    name: aidecheck.timer
-    state: started
+    name: {{{ aide_timer }}}
     enabled: true
     daemon_reload: true
+    state: started
     masked: false
   when: not ansible_check_mode
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/shared.sh
index 595783f93ce6..0dc43a84549f 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/shared.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/shared.sh
@@ -2,8 +2,17 @@
 
 {{{ bash_package_install("aide") }}}
 
+{{% set aide_service = 'aide.service' %}}
+{{% set aide_timer = 'aide.timer' %}}
+
+{{% if product in ["sle16"] %}}
+cat > /etc/aide_service.conf <<EOF
+@@include /etc/aide.conf
+EOF
+ln -s /usr/lib/systemd/system/{{{ aide_service }}} /etc/systemd/system/multi-user.target.wants/{{{ aide_service }}}
+{{% else %}}
 # create unit file for periodic aide database check
-cat > /etc/systemd/system/aidecheck.service <<EOF
+cat > /etc/systemd/system/{{{ aide_service }}} <<EOF
 [Unit]
 Description=Aide Check
 [Service]
@@ -12,28 +21,32 @@ ExecStart={{{ aide_bin_path }}} --check
 [Install]
 WantedBy=multi-user.target
 EOF
-chmod 0644 /etc/systemd/system/aidecheck.service
 
-# create unit file for the aide check timer
-cat > /etc/systemd/system/aidecheck.timer <<EOF
+# create unit file for the aide timer
+cat > /etc/systemd/system/{{{ aide_timer }}} <<EOF
 [Unit]
 Description=Aide check every day at 5AM
 [Timer]
 OnCalendar=*-*-* 05:00:00
-Unit=aidecheck.service
+Unit={{{ aide_service }}}
 [Install]
 WantedBy=multi-user.target
 EOF
 
 #  setup service unit files attributes
-chown root:root /etc/systemd/system/aidecheck.*
-chmod 0644 /etc/systemd/system/aidecheck.*
-
+chown root:root /etc/systemd/system/{{{ aide_timer }}}
+chmod 0644 /etc/systemd/system/{{{ aide_timer }}}
+chown root:root /etc/systemd/system/{{{ aide_service }}}
+chmod 0644 /etc/systemd/system/{{{ aide_service }}}
+{{% endif %}}
 # enable the aide related services
 systemctl daemon-reload
-systemctl enable aidecheck.service
-systemctl enable aidecheck.timer
+
+systemctl unmask {{{ aide_service }}}
+systemctl enable {{{ aide_service }}}
+systemctl unmask {{{ aide_timer }}}
+systemctl enable {{{ aide_timer }}}
 
 if [[ $(systemctl is-system-running) != "offline" ]]; then
-  systemctl start aidecheck.timer
+  systemctl start {{{ aide_timer }}}
 fi
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/oval/shared.xml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/oval/shared.xml
index 54a5f0535d5b..78f46f902891 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/oval/shared.xml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/oval/shared.xml
@@ -1,3 +1,5 @@
+{{% set aide_service = 'aide.service' %}}
+{{% set aide_timer = 'aide.timer' %}}
 <def-group>
   <definition class="compliance" id="{{{ rule_id }}}" version="3">
     {{{ oval_metadata("Make sure systemd timer is defined to run perodic AIDE check.", rule_title=rule_title) }}}
@@ -5,25 +7,25 @@
       <extend_definition comment="Aide is installed" definition_ref="package_aide_installed"/>
       <criteria operator="AND">
         <criterion test_ref="tst_aidecheck-service_enabled"
-          comment="systemd aidecheck.service enabled"/>
+          comment="systemd {{{ aide_service }}} enabled"/>
         <criterion test_ref="tst_aidecheck-timer_enabled"
           comment="systemd aidecheck.timer enabled"/>
         <criterion test_ref="tst_aidecheck-timer_active"
-          comment="systemd aidecheck.timer active"/>
+          comment="systemd {{{ aide_timer }}} active"/>
       </criteria>
     </criteria>
   </definition>
 
   <linux:systemdunitproperty_object id="obj_aidecheck-service_unitfilestate" version="1">
-    <linux:unit>aidecheck.service</linux:unit>
+    <linux:unit>{{{ aide_service }}}</linux:unit>
     <linux:property>UnitFileState</linux:property>
   </linux:systemdunitproperty_object>
   <linux:systemdunitproperty_object id="obj_aidecheck-timer_unitfilestate" version="1">
-    <linux:unit>aidecheck.timer</linux:unit>
+    <linux:unit>{{{ aide_timer }}}</linux:unit>
     <linux:property>UnitFileState</linux:property>
   </linux:systemdunitproperty_object>
   <linux:systemdunitproperty_object id="obj_aidecheck-timer_activestate" version="1">
-    <linux:unit>aidecheck.timer</linux:unit>
+    <linux:unit>{{{ aide_timer }}}</linux:unit>
     <linux:property>ActiveState</linux:property>
   </linux:systemdunitproperty_object>
   <linux:systemdunitproperty_state id="ste_aide_is_enabled" version="1">
@@ -34,7 +36,7 @@
   </linux:systemdunitproperty_state>
 
   <linux:systemdunitproperty_test check="all" id="tst_aidecheck-service_enabled" version="1"
-    comment="systemd aidecheck.service enabled">
+    comment="systemd {{{ aide_service }}} enabled">
     <linux:object object_ref="obj_aidecheck-service_unitfilestate" />
     <linux:state state_ref="ste_aide_is_enabled" />
   </linux:systemdunitproperty_test>
@@ -44,7 +46,7 @@
     <linux:state state_ref="ste_aide_is_enabled" />
   </linux:systemdunitproperty_test>
   <linux:systemdunitproperty_test check="all" id="tst_aidecheck-timer_active" version="1"
-    comment="systemd aidecheck.timer active">
+    comment="systemd {{{ aide_timer }}} active">
     <linux:object object_ref="obj_aidecheck-timer_activestate" />
     <linux:state state_ref="ste_aide_is_active" />
   </linux:systemdunitproperty_test>
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/tests/aide_timer_weekly.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/tests/aide_timer_weekly.pass.sh
index 3d0859291e15..626720af8423 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/tests/aide_timer_weekly.pass.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/tests/aide_timer_weekly.pass.sh
@@ -2,8 +2,14 @@
 # platform = multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_slmicro,multi_platform_almalinux
 # packages = aide
 
+{{% set aide_service = 'aide.service' %}}
+{{% set aide_timer = 'aide.timer' %}}
+
+{{% if product in ["sle16"] %}}
+ln -s /usr/lib/systemd/system/{{{ aide_service }}} /etc/systemd/system/multi-user.target.wants/{{{ aide_service }}}
+{{% else %}}
 # create unit file for periodic aide database check
-cat > /etc/systemd/system/aidecheck.service <<EOF
+cat > /etc/systemd/system/{{{ aide_service }}} <<EOF
 [Unit]
 Description=Aide Check
 [Service]
@@ -14,21 +20,22 @@ WantedBy=multi-user.target
 EOF
 
 # create unit file for the aide check timer
-cat > /etc/systemd/system/aidecheck.timer <<EOF
+cat > /etc/systemd/system/{{{ aide_timer }}} <<EOF
 [Unit]
 Description=Aide check every Monday
 [Timer]
 OnCalendar=Mon *-*-* 05:00:00
-Unit=aidecheck.service
+Unit={{{ aide_service }}}
 [Install]
 WantedBy=multi-user.target
 EOF
 
 #  setup service unit files attributes
-chown root:root /etc/systemd/system/aidecheck.*
-chmod 0644 /etc/systemd/system/aidecheck.*
+chown root:root /etc/systemd/system/aide.*
+chmod 0644 /etc/systemd/system/aide.*
+{{% endif %}}
 
 # enable the aide related services
 systemctl daemon-reload
-systemctl enable aidecheck.service
-systemctl --now enable aidecheck.timer
+systemctl enable {{{ aide_service }}}
+systemctl --now enable {{{ aide_timer }}}
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml
index 5327b9672ca7..b7a6da943ca9 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml
@@ -5,6 +5,9 @@
 # disruption = low
 - (xccdf-var var_aide_scan_notification_email)
 
+{{% set aide_service = 'aide.service' %}}
+{{% set aide_notify_service = 'aidecheck-notify.service' %}}
+
 - name: "{{{ rule_title }}} - Ensure AIDE is installed"
   ansible.builtin.package:
     name: "{{ item }}"
@@ -12,40 +15,99 @@
   with_items:
     - aide
 
+{{% if product in ["sle16"] %}}
+- name: "{{{ rule_title }}} - Ensure report_url is set to file:/var/log/aide-report.log in /etc/aide.conf"
+  ansible.builtin.lineinfile:
+    path: /etc/aide.conf
+    line: "report_url=file:/var/log/aide-report.log"
+  when:
+    - '"packages" in ansible_facts'
+    - '"aide" in ansible_facts["packages"]'
+{{% endif %}}
+
+{{% if 'suse' in families and product != 'sle12' %}}
+{{% if product in ["sle16"] %}}
+{{% set aide_service_unit = "/usr/lib/systemd/system/" ~ aide_service %}}
+{{% set aide_notify_unit = "/usr/lib/systemd/system/" ~ aide_notify_service %}}
+{{% else %}}
+{{% set aide_service_unit = "/etc/systemd/system/" ~ aide_service %}}
+{{% set aide_notify_unit = "/etc/systemd/system/" ~ aide_notify_service %}}
+{{% endif %}}
+- name: "{{{ rule_title }}} - Gather Service facts"
+  ansible.builtin.service_facts:
+
+- name: "{{{ rule_title }}} - Add Before={{{ aide_notify_service }}} in Unit section on AIDE Check Service {{{ aide_service }}}"
+  community.general.ini_file:
+    dest: {{{ aide_service_unit }}}
+    section: Unit
+    option: Before
+    value: "{{{ aide_notify_service }}}"
+    no_extra_spaces: true
+  when:
+    - '"services" in ansible_facts'
+    - '"{{{ aide_service }}}" in ansible_facts["services"]'
+
+- name: "{{{ rule_title }}} - Add Wants {{{ aide_notify_service }}} in Unit section on AIDE Check Service {{{ aide_service }}}"
+  community.general.ini_file:
+    dest: {{{ aide_service_unit }}}
+    section: Unit
+    option: Wants
+    value: "{{{ aide_notify_service }}}"
+    no_extra_spaces: true
+  when:
+    - '"services" in ansible_facts'
+    - '"{{{ aide_service }}}" in ansible_facts["services"]'
+
 {{% if product in ["sle15", "slmicro5", "slmicro6"] %}}
-- name: "{{{ rule_title }}} - Check Service"
-  ansible.builtin.blockinfile:
-      create: yes
-      dest: /etc/systemd/system/aidecheck.service
+- name: "{{{ rule_title }}} - Add report url in AIDE Check Service {{{ aide_service }}}"
+  community.general.ini_file:
+    dest: {{{ aide_service_unit }}}
+    section: Service
+    option: ExecStart
+    value: {{{ aide_bin_path }}} --check -r file:/var/log/aide-report.log
+    no_extra_spaces: true
+  when:
+    - '"services" in ansible_facts'
+    - '"{{{ aide_service }}}" in ansible_facts["services"]'
+{{% endif %}}
+
+- name: "{{{ rule_title }}} - Create AIDE Check Service {{{ aide_service }}}"
+  ansible.builtin.copy:
+      dest: {{{ aide_service_unit }}}
       owner: root
       group: root
-      mode: '0644'
-      block: |
+      mode: 0644
+      content: |-
         [Unit]
         Description=Aide Check
-        Before=aidecheck-notify.service
-        Wants=aidecheck-notify.service
+        Before={{{ aide_notify_service }}}
+        Wants={{{ aide_notify_service }}}
         [Service]
         Type=forking
-        ExecStart={{{ aide_bin_path }}} --check -r file:/tmp/aide-report.log
+        ExecStart={{{ aide_bin_path }}} --check -r file:/var/log/aide-report.log
         [Install]
         WantedBy=multi-user.target
+  when:
+    - '"services" in ansible_facts'
+    - '"{{{ aide_service }}}" not in ansible_facts["services"]'
 
-- name: "{{{ rule_title }}} - Notify Service"
-  ansible.builtin.blockinfile:
-      create: yes
-      dest: /etc/systemd/system/aidecheck-notify.service
+- name: "{{{ rule_title }}} - AIDE Notify Service {{{ aide_notify_service }}} "
+  ansible.builtin.copy:
+      dest: {{{ aide_notify_unit }}}
       owner: root
       group: root
-      mode: '0644'
-      block: |
+      mode: 0644
+      content: |-
         [Unit]
         Description=Status email for AIDE check result
-        After=aidecheck.service
+        After={{{ aide_service }}}
         [Service]
         Type=forking
-        ExecStart=/bin/sh -c 'cat /tmp/aide-report.log | /bin/mail -s "$(hostname) - AIDE Integrity Check"  {{ var_aide_scan_notification_email }}'
+        ExecStart=/bin/sh -c 'cat /var/log/aide-report.log | /bin/mail -s "$(hostname) - AIDE Integrity Check"  {{ var_aide_scan_notification_email }}'
 
+- name: "{{{ rule_title }}} - systemd reload config"
+  ansible.builtin.systemd:
+    daemon_reload: true
 {{% else %}}
 - name: "{{{ rule_title }}} - Setup Cron Tab"
   ansible.builtin.cron:
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh
index 42b56e5d520a..0927f701aa49 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh
@@ -1,31 +1,56 @@
 # platform = multi_platform_all
 
+{{% set aide_service = 'aide.service' %}}
+{{% set aide_notify_service = 'aidecheck-notify.service' %}}
+
 {{{ bash_package_install("aide") }}}
 {{{ bash_instantiate_variables("var_aide_scan_notification_email") }}}
 
+{{% if product in ["sle16"] %}}
+{{% set aide_service_unit = "/usr/lib/systemd/system/" ~ aide_service %}}
+{{% set aide_notify_unit = "/usr/lib/systemd/system/" ~ aide_notify_service %}}
+{{{ lineinfile_present('/etc/aide.conf','report_url=file:/var/log/aide-report.log') }}}
+{{% else %}}
+{{% set aide_service_unit = "/etc/systemd/system/" ~ aide_service %}}
+{{% set aide_notify_unit = "/etc/systemd/system/" ~ aide_notify_service %}}
+{{% endif %}}
+
+{{% if 'suse' in families and product != 'sle12' %}}
+if [ -e "{{{ aide_service_unit }}}" ] ; then
+{{{ bash_ensure_ini_config(aide_service_unit, "Unit", "Before", aide_notify_service) }}}
+{{{ bash_ensure_ini_config(aide_service_unit, "Unit", "Wants", aide_notify_service) }}}
 {{% if product in ["sle15", "slmicro5", "slmicro6"] %}}
+{{{ bash_ensure_ini_config(aide_service_unit, "Service", "ExecStart", aide_bin_path ~ " --check -r file:/var/log/aide-report.log") }}}
+{{% endif %}}
+else
 # create unit file for periodic aide database check
-cat > /etc/systemd/system/aidecheck.service <<CHECKEOF
+cat > {{{ aide_service_unit }}} <<CHECKEOF
 [Unit]
-        Description=Aide Check
-        Before=aidecheck-notify.service
-        Wants=aidecheck-notify.service
-        [Service]
-        Type=forking
-        ExecStart=/usr/bin/aide --check -r file:/tmp/aide-report.log
-        [Install]
-        WantedBy=multi-user.target
+Description=Aide Check
+Before={{{ aide_notify_service }}}
+Wants={{{ aide_notify_service }}}
+[Service]
+Type=forking
+ExecStart={{{ aide_bin_path }}} --check -r file:/var/log/aide-report.log
+[Install]
+WantedBy=multi-user.target
 CHECKEOF
-chmod 0644 /etc/systemd/system/aidecheck.service
-cat > /etc/systemd/system/aidecheck-notify.service <<NOTIFYEOF
+
+chmod 0644 {{{ aide_service_unit }}}
+fi
+
+cat > {{{ aide_notify_unit }}} <<NOTIFYEOF
 [Unit]
-        Description=Status email for AIDE check result
-        After=aidecheck.service
-        [Service]
-        Type=forking
-        ExecStart=/bin/sh -c 'cat /tmp/aide-report.log | /bin/mail -s "$(hostname) - AIDE Integrity Check"  $var_aide_scan_notification_email'
+Description=Status email for AIDE check result
+After={{{ aide_service }}}
+[Service]
+Type=forking
+ExecStart=/bin/sh -c 'cat /var/log/aide-report.log | /bin/mail -s "$(hostname) - AIDE Integrity Check"  $var_aide_scan_notification_email'
 NOTIFYEOF
-chmod 0644 /etc/systemd/system/aidecheck-notify.service
+
+chmod 0644 {{{ aide_notify_unit }}}
+systemctl daemon-reload
+
 {{% else %}}
 CRONTAB=/etc/crontab
 CRONDIRS='/etc/cron.d /etc/cron.daily /etc/cron.weekly /etc/cron.monthly'
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/oval/shared.xml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/oval/shared.xml
index cf0dba3bb460..e2377258b8cc 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/oval/shared.xml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/oval/shared.xml
@@ -1,3 +1,6 @@
+{{% set aide_service = 'aide.service' %}}
+{{% set aide_notify_service = 'aidecheck-notify.service' %}}
+
 <def-group>
   <definition class="compliance" id="aide_scan_notification" version="1">
     {{{ oval_metadata("AIDE should notify appropriate personnel of the details
@@ -11,7 +14,7 @@
           test_ref="test_aide_var_cron_notification" />
         <criterion comment="notify personnel when aide completes in cron.(d|daily|weekly|monthly)"
           test_ref="test_aide_crontabs_notification" />
-{{% if product in ["sle15", "slmicro5", "slmicro6"] %}}
+{{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}}
         <criteria operator="AND">
           <criterion comment="notification started after check"
             test_ref="test_aidecheck_systemd_scan_before_notification"/>
@@ -52,7 +55,7 @@
     <ind:pattern operation="pattern match">^.*{{{ aide_bin_path }}}[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.+@.+$</ind:pattern>
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
   </ind:textfilecontent54_object>
-{{% if product in ["sle15", "slmicro5", "slmicro6"] %}}
+{{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}}
   <ind:textfilecontent54_test check="all" check_existence="all_exist"
     id="test_aidecheck_systemd_scan_report" version="1"
     comment="report results of aide check, when started by systemd">
@@ -60,8 +63,12 @@
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_aidecheck_systemd_report" version="1"
     comment="run aide check with output to a report file">
-    <ind:filepath>/etc/systemd/system/aidecheck.service</ind:filepath>
-    <ind:pattern operation="pattern match">^.*ExecStart\=.*/usr/bin/aide[\s]*\-\-check.*\-r\s*file:\/w*.*$</ind:pattern>
+    {{% if product in ["sle16"] %}}
+    <ind:filepath>/usr/lib/systemd/system/{{{ aide_service }}}</ind:filepath>
+    {{% else %}}
+    <ind:filepath>/etc/systemd/system/{{{ aide_service }}}</ind:filepath>
+    {{% endif %}}
+    <ind:pattern operation="pattern match">^.*ExecStart\=.*/usr/bin/aide[\s]*\-\-check.*$</ind:pattern>
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
   </ind:textfilecontent54_object>
   <ind:textfilecontent54_test check="all" check_existence="all_exist"
@@ -71,8 +78,12 @@
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_aidecheck_systemd_before_notification" version="1"
     comment="run aide check before notification">
-    <ind:filepath>/etc/systemd/system/aidecheck.service</ind:filepath>
-    <ind:pattern operation="pattern match">^.*Before\=.*aidecheck-notify.service.*$</ind:pattern>
+    {{% if product in ["sle16"] %}}
+    <ind:filepath>/usr/lib/systemd/system/{{{ aide_service }}}</ind:filepath>
+    {{% else %}}
+    <ind:filepath>/etc/systemd/system/{{{ aide_service }}}</ind:filepath>
+    {{% endif %}}
+    <ind:pattern operation="pattern match">^.*Before\=.*{{{ aide_notify_service }}}.*$</ind:pattern>
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
   </ind:textfilecontent54_object>
   <ind:textfilecontent54_test check="all" check_existence="any_exist"
@@ -82,8 +93,12 @@
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="object_aidecheck_for_notification_enabled" version="1"
     comment="list of dependencies should include aidecheck.service">
-    <ind:filepath>/etc/systemd/system/aidecheck.service</ind:filepath>
-    <ind:pattern operation="pattern match">^.*Wants\=.*aidecheck-notify.service.*$</ind:pattern>
+    {{% if product in ["sle16"] %}}
+    <ind:filepath>/usr/lib/systemd/system/{{{ aide_service }}}</ind:filepath>
+    {{% else %}}
+    <ind:filepath>/etc/systemd/system/{{{ aide_service }}}</ind:filepath>
+    {{% endif %}}
+    <ind:pattern operation="pattern match">^.*Wants\=.*{{{ aide_notify_service }}}.*$</ind:pattern>
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
   </ind:textfilecontent54_object>
 {{% endif %}}
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml
index 5788f259eac1..ceca9f3551ab 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml
@@ -50,11 +50,17 @@ references:
     stigid@ol8: OL08-00-010360
     stigid@sle12: SLES-12-010510
 
+{{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}}
+platform: package[aide] and package[systemd]
+{{% else %}}
+platform: package[aide]
+{{% endif %}}
+
 ocil_clause: 'AIDE has not been configured or has not been configured to notify personnel of scan details'
 
 ocil: |-
     To determine that periodic AIDE execution has been scheduled, run the following command:
-{{% if product in ["sle15", "slmicro5", "slmicro6"] %}}
+{{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}}
     <pre>$ sudo systemctl status  aidecheck-notify|grep loaded</pre>
     The output should return that the service is loaded.
     Also we should make sure that notification service is started by the check:
@@ -73,7 +79,7 @@ fixtext: |-
     The AIDE tool can be configured to email designated personnel with the use of the cron system.
 
     The following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis.
-{{% if product in ["sle15", "slmicro5", "slmicro6"] %}}
+{{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}}
     $ cat > /etc/systemd/system/aidecheck-notify.service <<NOTIFYEOF
     [Unit]
         Description=Status email for AIDE check result
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_use_fips_hashes/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_use_fips_hashes/bash/shared.sh
index 97c8bb0d45e8..6c5aa806fe38 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_use_fips_hashes/bash/shared.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_use_fips_hashes/bash/shared.sh
@@ -1,4 +1,4 @@
-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_almalinux
+# platform = Red Hat Virtualization 4,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel
 
 {{{ bash_package_install("aide") }}}
 
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/correct_value.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/correct_value.pass.sh
index 3881ea90b57f..c9d12163b018 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/correct_value.pass.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/correct_value.pass.sh
@@ -1,7 +1,6 @@
 #!/bin/bash
 # packages = aide
-# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux
-
+# platform = Red Hat Virtualization 4,multi_platform_almalinux,multi_platform_ol,multi_platform_rhel,multi_platform_sle
 
 cat >/etc/aide.conf <<EOL
 All = p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/correct_value_inline.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/correct_value_inline.pass.sh
index 5f8401a0d574..d5bf6c2b1f44 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/correct_value_inline.pass.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/correct_value_inline.pass.sh
@@ -1,7 +1,6 @@
 #!/bin/bash
 # packages = aide
-# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux
-
+# platform = Red Hat Virtualization 4,multi_platform_almalinux,multi_platform_ol,multi_platform_rhel,multi_platform_sle
 
 cat >/etc/aide.conf <<EOL
 All = p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/wrong_value.fail.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/wrong_value.fail.sh
index daed42215da7..6747cf206c68 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/wrong_value.fail.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/wrong_value.fail.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # packages = aide
-# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux
+# platform = Red Hat Virtualization 4,multi_platform_almalinux,multi_platform_ol,multi_platform_rhel,multi_platform_sle
 
 
 cat >/etc/aide.conf <<EOL
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/wrong_value_inline.fail.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/wrong_value_inline.fail.sh
index a4de99337031..7c1f2b6c5399 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/wrong_value_inline.fail.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/wrong_value_inline.fail.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # packages = aide
-# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux
+# platform = Red Hat Virtualization 4,multi_platform_almalinux,multi_platform_ol,multi_platform_rhel,multi_platform_sle
 
 
 cat >/etc/aide.conf <<EOL
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_group_ownership/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_group_ownership/rule.yml
index 14ae48acef93..602cef8b5d9d 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_group_ownership/rule.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_group_ownership/rule.yml
@@ -61,15 +61,18 @@ srg_requirement: '{{{ full_name }}} audit tools must be group-owned by root.'
 template:
     name: file_groupowner
     vars:
+        {{% if 'suse' in families %}}
+        filepath: {{{ audit_binaries }}}
+        {{% else %}}
         filepath:
             - /sbin/auditctl
             - /sbin/aureport
             - /sbin/ausearch
-            {{% if product not in ['rhel10', 'ol10', 'sle16', 'fedora'] %}}
+            {{% if product not in ['rhel10', 'ol10', 'fedora'] %}}
             - /sbin/autrace
             {{% endif %}}
             - /sbin/auditd
             - /sbin/rsyslogd
             - /sbin/augenrules
+        {{% endif %}}
         gid_or_name: '0'
-
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_ownership/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_ownership/rule.yml
index 3449ccd32222..de292081a897 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_ownership/rule.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_ownership/rule.yml
@@ -61,14 +61,18 @@ srg_requirement: '{{{ full_name }}} audit tools must be owned by root.'
 template:
     name: file_owner
     vars:
+        {{% if 'suse' in families %}}
+        filepath: {{{ audit_binaries }}}
+        {{% else %}}
         filepath:
             - /sbin/auditctl
             - /sbin/aureport
             - /sbin/ausearch
-            {{% if product not in ['rhel10', 'ol10', 'sle16', 'fedora'] %}}
+            {{% if product not in ['rhel10', 'ol10', 'fedora'] %}}
             - /sbin/autrace
             {{% endif %}}
             - /sbin/auditd
             - /sbin/rsyslogd
             - /sbin/augenrules
+        {{% endif %}}
         uid_or_name: '0'
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_permissions/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_permissions/rule.yml
index 75a902bdad79..04df8c0fbc82 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_permissions/rule.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_permissions/rule.yml
@@ -51,14 +51,18 @@ srg_requirement: '{{{ full_name }}} audit tools must have a mode of 0755 or less
 template:
     name: file_permissions
     vars:
+        {{% if 'suse' in families %}}
+        filepath: {{{ audit_binaries }}}
+        {{% else %}}
         filepath:
             - /sbin/auditctl
             - /sbin/aureport
             - /sbin/ausearch
-            {{% if product not in ['rhel10', 'ol10', 'sle16', 'fedora'] %}}
+            {{% if product not in ['rhel10', 'ol10', 'fedora'] %}}
             - /sbin/autrace
             {{% endif %}}
             - /sbin/auditd
             - /sbin/rsyslogd
             - /sbin/augenrules
+        {{% endif %}}
         filemode: '0755'

From 7e7e992ede5ba09ef869a5f69dc92de548896cd1 Mon Sep 17 00:00:00 2001
From: Yavor Georgiev <yavor.georgiev@bgosoftware.com>
Date: Sun, 20 Sep 2026 12:53:02 +0300
Subject: [PATCH 3/5] Fix tests according to copilot suggestion

---
 .../aide/aide_check_audit_tools/tests/correct.pass.sh           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh
index db6c7ee6567c..9b3c6fc05734 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh
@@ -15,7 +15,7 @@ echo >> {{{ aide_conf_path }}}
 for theFile in "${bins[@]}"
 do
     {{% if product in ['sle16'] %}}
-    echo "$theFile p+i+n+u+g+s+b+acl+sha512"  >> {{{ aide_conf_path }}}
+    echo "$theFile p+i+n+u+g+s+b+acl+selinux+sha512"  >> {{{ aide_conf_path }}}
     {{% else %}}
     echo "$theFile p+i+n+u+g+s+b+acl+xattrs+sha512"  >> {{{ aide_conf_path }}}
     {{% endif %}}

From 9d2360d67875f83e640d6bc2d028dcada493fbbb Mon Sep 17 00:00:00 2001
From: Yavor Georgiev <yavor.georgiev@bgosoftware.com>
Date: Sun, 20 Sep 2026 12:54:03 +0300
Subject: [PATCH 4/5] Fix aide_scan_notification check and remediations
 according to copilot review

- added check for setting report_url=file:/var/log/aide-report.log in /etc/aide.conf
- make sure we do not end up with duplicating report_url=file:/var/log/aide-report.log entries
- in the oval for sle15 use previous file regex
---
 .../aide_scan_notification/ansible/shared.yml |  7 -------
 .../aide_scan_notification/bash/shared.sh     |  3 ++-
 .../aide_scan_notification/oval/shared.xml    | 20 ++++++++++++++++++-
 .../aide/aide_scan_notification/rule.yml      |  8 ++++++--
 4 files changed, 27 insertions(+), 11 deletions(-)

diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml
index b7a6da943ca9..94b953c23f3a 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml
@@ -8,13 +8,6 @@
 {{% set aide_service = 'aide.service' %}}
 {{% set aide_notify_service = 'aidecheck-notify.service' %}}
 
-- name: "{{{ rule_title }}} - Ensure AIDE is installed"
-  ansible.builtin.package:
-    name: "{{ item }}"
-    state: present
-  with_items:
-    - aide
-
 {{% if product in ["sle16"] %}}
 - name: "{{{ rule_title }}} - Ensure report_url is set to file:/var/log/aide-report.log in /etc/aide.conf"
   ansible.builtin.lineinfile:
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh
index 0927f701aa49..7aa95c753455 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh
@@ -9,7 +9,8 @@
 {{% if product in ["sle16"] %}}
 {{% set aide_service_unit = "/usr/lib/systemd/system/" ~ aide_service %}}
 {{% set aide_notify_unit = "/usr/lib/systemd/system/" ~ aide_notify_service %}}
-{{{ lineinfile_present('/etc/aide.conf','report_url=file:/var/log/aide-report.log') }}}
+{{{ lineinfile_absent('/etc/aide.conf', 'report_url=file:/var/log/aide-report.log', sed_path_separator="#") }}}
+{{{ lineinfile_present('/etc/aide.conf', 'report_url=file:/var/log/aide-report.log') }}}
 {{% else %}}
 {{% set aide_service_unit = "/etc/systemd/system/" ~ aide_service %}}
 {{% set aide_notify_unit = "/etc/systemd/system/" ~ aide_notify_service %}}
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/oval/shared.xml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/oval/shared.xml
index e2377258b8cc..6fd712841865 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/oval/shared.xml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/oval/shared.xml
@@ -22,6 +22,10 @@
             test_ref="test_aidecheck_systemd_scan_wants_notification"/>
           <criterion comment="systemd aidecheck scan notification test"
             test_ref="test_aidecheck_systemd_scan_report"/>
+          {{% if product in [ "sle16" ] %}}
+          <criterion comment="report url set to /var/log/aide-report.log"
+            test_ref="test_report_url_in_aide_conf"/>
+          {{% endif %}}
         </criteria>
 {{% endif %}}
       </criteria>
@@ -65,10 +69,11 @@
     comment="run aide check with output to a report file">
     {{% if product in ["sle16"] %}}
     <ind:filepath>/usr/lib/systemd/system/{{{ aide_service }}}</ind:filepath>
+    <ind:pattern operation="pattern match">^.*ExecStart\=.*/usr/bin/aide[\s]*\-\-check.*$</ind:pattern>
     {{% else %}}
     <ind:filepath>/etc/systemd/system/{{{ aide_service }}}</ind:filepath>
+    <ind:pattern operation="pattern match">^.*ExecStart\=.*/usr/bin/aide[\s]*\-\-check.*\-r\s*file:\/w*.*$</ind:pattern>
     {{% endif %}}
-    <ind:pattern operation="pattern match">^.*ExecStart\=.*/usr/bin/aide[\s]*\-\-check.*$</ind:pattern>
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
   </ind:textfilecontent54_object>
   <ind:textfilecontent54_test check="all" check_existence="all_exist"
@@ -101,5 +106,18 @@
     <ind:pattern operation="pattern match">^.*Wants\=.*{{{ aide_notify_service }}}.*$</ind:pattern>
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
   </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
+  comment="check for client report_url = file:/var/log/aide-report.log in /etc/aide.conf"
+  id="test_report_url_in_aide_conf" version="1">
+    <ind:object object_ref="obj_report_url_in_aide_conf" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="obj_report_url_in_aide_conf" version="1">
+    <ind:filepath>/etc/aide.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[ \t]*report_url[\s]*=[\s]*file:/var/log/aide-report.log</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
 {{% endif %}}
 </def-group>
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml
index ceca9f3551ab..c5730dc46c9c 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml
@@ -80,13 +80,17 @@ fixtext: |-
 
     The following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis.
 {{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}}
+{{% if product in ["sle16"] %}}
+    $ cat > /usr/lib/systemd/system/aidecheck-notify.service <<NOTIFYEOF
+{{% else %}}
     $ cat > /etc/systemd/system/aidecheck-notify.service <<NOTIFYEOF
+{{% endif %}}
     [Unit]
         Description=Status email for AIDE check result
-        After=aidecheck.service
+        After=aide.service
         [Service]
         Type=forking
-        ExecStart=/bin/sh -c 'cat /tmp/aide-report.log | /bin/mail -s "$(hostname) - AIDE Integrity Check"  $var_aide_scan_notification_email'
+        ExecStart=/bin/sh -c 'cat /var/log/aide-report.log | /bin/mail -s "$(hostname) - AIDE Integrity Check"  $var_aide_scan_notification_email'
     NOTIFYEOF
 {{% else %}}
     $ sudo more /etc/cron.daily/aide

From ec7bc44fd5f6bfc012263f3f5946466ef92c207b Mon Sep 17 00:00:00 2001
From: Yavor Georgiev <yavor.georgiev@bgosoftware.com>
Date: Sun, 20 Sep 2026 13:00:06 +0300
Subject: [PATCH 5/5] Use suse family condition for new behaviour - also drop
 unneeded quotes and fix ocil descriptions

---
 .../ansible/shared.yml                                |  7 ++++++-
 .../bash/shared.sh                                    |  5 +++++
 .../oval/shared.xml                                   |  5 +++++
 .../tests/aide_timer_weekly.pass.sh                   |  5 +++++
 .../aide/file_audit_tools_group_ownership/rule.yml    |  9 ++++++++-
 .../aide/file_audit_tools_ownership/rule.yml          | 11 +++++++++--
 .../aide/file_audit_tools_permissions/rule.yml        |  7 +++++++
 7 files changed, 45 insertions(+), 4 deletions(-)

diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/shared.yml
index 5c7d035a78bb..774dbc80c97e 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/shared.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/shared.yml
@@ -4,8 +4,13 @@
 # complexity = low
 # disruption = low
 
+{{% if 'suse' in families %}}
 {{% set aide_service = 'aide.service' %}}
 {{% set aide_timer = 'aide.timer' %}}
+{{% else %}}
+{{% set aide_service = 'aidecheck.service' %}}
+{{% set aide_timer = 'aidecheck.timer' %}}
+{{% endif %}}
 
 {{% if product in ["sle16"] %}}
 - name: "{{{ rule_title }}} - Make sure AIDE Check Service is including /etc/aide.conf"
@@ -15,7 +20,7 @@
       group: root
       mode: 0600
       content: |-
-        "@@include /etc/aide.conf"
+        @@include /etc/aide.conf
 
 - name: "{{{ rule_title }}} - Make sure AIDE Check Service is in enabled state"
   ansible.builtin.file:
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/shared.sh
index 0dc43a84549f..4f9fb65c2b3f 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/shared.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/shared.sh
@@ -2,8 +2,13 @@
 
 {{{ bash_package_install("aide") }}}
 
+{{% if 'suse' in families %}}
 {{% set aide_service = 'aide.service' %}}
 {{% set aide_timer = 'aide.timer' %}}
+{{% else %}}
+{{% set aide_service = 'aidecheck.service' %}}
+{{% set aide_timer = 'aidecheck.timer' %}}
+{{% endif %}}
 
 {{% if product in ["sle16"] %}}
 cat > /etc/aide_service.conf <<EOF
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/oval/shared.xml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/oval/shared.xml
index 78f46f902891..9f0a842593c3 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/oval/shared.xml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/oval/shared.xml
@@ -1,5 +1,10 @@
+{{% if 'suse' in families %}}
 {{% set aide_service = 'aide.service' %}}
 {{% set aide_timer = 'aide.timer' %}}
+{{% else %}}
+{{% set aide_service = 'aidecheck.service' %}}
+{{% set aide_timer = 'aidecheck.timer' %}}
+{{% endif %}}
 <def-group>
   <definition class="compliance" id="{{{ rule_id }}}" version="3">
     {{{ oval_metadata("Make sure systemd timer is defined to run perodic AIDE check.", rule_title=rule_title) }}}
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/tests/aide_timer_weekly.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/tests/aide_timer_weekly.pass.sh
index 626720af8423..a60033db72b1 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/tests/aide_timer_weekly.pass.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/tests/aide_timer_weekly.pass.sh
@@ -2,8 +2,13 @@
 # platform = multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_slmicro,multi_platform_almalinux
 # packages = aide
 
+{{% if 'suse' in families %}}
 {{% set aide_service = 'aide.service' %}}
 {{% set aide_timer = 'aide.timer' %}}
+{{% else %}}
+{{% set aide_service = 'aidecheck.service' %}}
+{{% set aide_timer = 'aidecheck.timer' %}}
+{{% endif %}}
 
 {{% if product in ["sle16"] %}}
 ln -s /usr/lib/systemd/system/{{{ aide_service }}} /etc/systemd/system/multi-user.target.wants/{{{ aide_service }}}
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_group_ownership/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_group_ownership/rule.yml
index 602cef8b5d9d..dfbbde3dd363 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_group_ownership/rule.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_group_ownership/rule.yml
@@ -33,7 +33,13 @@ ocil: |-
 
     Check the group-owner of each audit tool by running the following command:
 
-    {{% if product in ['rhel10', 'ol10', 'sle16', 'fedora'] %}}
+    {{% if 'suse' in families %}}
+    $ sudo stat -c "%G %n" {{{ audit_binaries | join(' ') }}}
+    {{% for audit_binary in audit_binaries %}}
+    root {{{ audit_binary }}}
+    {{% endfor %}}
+    {{% else %}}
+    {{% if product in ['rhel10', 'ol10', 'fedora'] %}}
     $ sudo stat -c "%G %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/auditd /sbin/rsyslogd /sbin/augenrules
     {{% else %}}
     $ sudo stat -c "%G %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules
@@ -48,6 +54,7 @@ ocil: |-
     root /sbin/auditd
     root /sbin/rsyslogd
     root /sbin/augenrules
+    {{% endif %}}
 
 fixtext: |-
     Configure the audit tools to be group-owned by "root", by running the following command:
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_ownership/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_ownership/rule.yml
index de292081a897..f76c324b5d55 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_ownership/rule.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_ownership/rule.yml
@@ -33,7 +33,13 @@ ocil: |-
 
     Check the owner of each audit tool by running the following command:
 
-    {{% if product in ['rhel10', 'ol10', 'sle16', 'fedora'] %}}
+    {{% if 'suse' in families %}}
+    $ sudo stat -c "%U %n" {{{ audit_binaries | join(' ') }}}
+    {{% for audit_binary in audit_binaries %}}
+    root {{{ audit_binary }}}
+    {{% endfor %}}
+    {{% else %}}
+    {{% if product in ['rhel10', 'ol10', 'fedora'] %}}
     $ sudo stat -c "%U %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/auditd /sbin/rsyslogd /sbin/augenrules
     {{% else %}}
     $ sudo stat -c "%U %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules
@@ -42,12 +48,13 @@ ocil: |-
     root /sbin/auditctl
     root /sbin/aureport
     root /sbin/ausearch
-    {{% if product not in ['rhel10', 'ol10', 'sle16', 'fedora'] %}}
+    {{% if product not in ['rhel10', 'ol10', 'fedora'] %}}
     root /sbin/autrace
     {{% endif %}}
     root /sbin/auditd
     root /sbin/rsyslogd
     root /sbin/augenrules
+    {{% endif %}}
 
 fixtext: |-
     Configure the audit tools to be owned by "root", by running the following command:
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_permissions/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_permissions/rule.yml
index 04df8c0fbc82..f66bacb5cf3a 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_permissions/rule.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_permissions/rule.yml
@@ -33,11 +33,18 @@ ocil: |-
 
     Check the octal permission of each audit tool by running the following command:
 
+    {{% if 'suse' in families %}}
+    $ sudo stat -c "%a %n" {{{ audit_binaries | join(' ') }}}
+    {{% for audit_binary in audit_binaries %}}
+    750 {{{ audit_binary }}}
+    {{% endfor %}}
+    {{% else %}}
     {{% if product in ['rhel10', 'ol10', 'sle16', 'fedora'] %}}
     $ sudo stat -c "%U %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/auditd /sbin/rsyslogd /sbin/augenrules
     {{% else %}}
     $ sudo stat -c "%U %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules
     {{% endif %}}
+    {{% endif %}}
 
 fixtext: |-
     Configure the audit tools to be owned by "root", by running the following command: