CCI-000126

Specify the organization-defined event types (subset of the event types defined in AU-2a) along with the frequency of (or situation requiring logging for each identified event type.

34 rules found Severity: Medium

8 rules found Severity: Medium

7 rules found Severity: Medium

6 rules found Severity: Medium

7 rules found Severity: Medium

6 rules found Severity: Medium

5 rules found

1 rule found Severity: Medium

CCI-000126

Ensure auditd Collects System Administrator Actions

Enable auditd Service

Record Events that Modify the System's Discretionary Access Controls - chmod

Record Events that Modify the System's Discretionary Access Controls - chown

Record Events that Modify the System's Discretionary Access Controls - fchmod

Record Events that Modify the System's Discretionary Access Controls - fchmodat

Record Events that Modify the System's Discretionary Access Controls - fchown

Record Events that Modify the System's Discretionary Access Controls - fchownat

Record Events that Modify the System's Discretionary Access Controls - fsetxattr

Record Events that Modify the System's Discretionary Access Controls - lchown

Record Events that Modify the System's Discretionary Access Controls - lsetxattr

Record Events that Modify the System's Discretionary Access Controls - setxattr

Record Attempts to Alter Logon and Logout Events - faillock

Record Attempts to Alter Logon and Logout Events - lastlog

Record Attempts to Alter Logon and Logout Events - tallylog

Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces

Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default

The Red Hat Enterprise Linux operating system must audit all uses of the chown, fchown, fchownat, and lchown syscalls.

The Red Hat Enterprise Linux operating system must generate audit records for all unsuccessful account access events.

The Red Hat Enterprise Linux operating system must generate audit records for all successful account access events.

The Oracle Linux operating system must audit all uses of the chown, fchown, fchownat, and lchown syscalls.