Capacity
CCI-000134
Ensure that audit records containing information that establishes the outcome of the event.
1
Rule
Severity: High
Enable audit Service
29
Rule
Severity: Medium
Ensure the audit Subsystem is Installed
30
Rule
Severity: Medium
Enable auditd Service
3
Rule
Severity: Medium
Ensure the audit-libs package as a part of audit Subsystem is Installed
2
Rule
Severity: Medium
Ensure the libaudit1 package as a part of audit Subsystem is Installed
2
Rule
Severity: Medium
AAA Services configuration audit records must identify the outcome of the events.
4
Rule
Severity: Medium
The Apache web server must produce log records containing sufficient information to establish what type of events occurred.
2
Rule
Severity: Medium
The ALG must produce audit records containing information to establish the outcome of the events.
2
Rule
Severity: Medium
The Arista router must be configured to produce audit records containing information to establish where the events occurred.
4
Rule
Severity: Medium
The application server must produce log records that contain sufficient information to establish the outcome of events.
2
Rule
Severity: Medium
The Arista network device must be configured to capture all DOD auditable events.
2
Rule
Severity: Medium
The application must produce audit records that contain information to establish the outcome of the events.
1
Rule
Severity: Medium
The CA API Gateway must produce audit records containing information to establish the outcome of the events.
2
Rule
Severity: Low
A BIND 9.x server implementation must be configured to allow DNS administrators to audit all DNS server components, based on selectable event criteria, and produce audit records within all DNS server components that contain information for failed security verification tests, information to establish the outcome and source of the events, any information necessary to determine cause of failure, and any information necessary to return to operations with least disruption to mission processes.
2
Rule
Severity: Low
The Central Log Server must produce audit records that contain information to establish the outcome of the events.
1
Rule
Severity: Low
The DBN-6300 must produce audit records that contain information to establish the outcome of the event.
1
Rule
Severity: Medium
The audit log configuration level must be set to request in the Universal Control Plane (UCP) component of Docker Enterprise.
1
Rule
Severity: Medium
The host operating systems auditing policies for the Docker Engine - Enterprise component of Docker Enterprise must be set.
2
Rule
Severity: Medium
The DNS server implementation must produce audit records that contain information to establish the outcome of the events.
2
Rule
Severity: Medium
The firewall must generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the firewall rule.
1
Rule
Severity: Medium
The FortiGate firewall must generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the firewall rule.
1
Rule
Severity: Low
The HP FlexFabric Switch must produce audit records that contain information to establish the outcome of the event.
1
Rule
Severity: Medium
The HYCU server must produce audit records containing information to establish when events occurred, where events occurred, the source of the event, the outcome of the event, and identity of any individual or process associated with the event.
1
Rule
Severity: Medium
DB2 must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
1
Rule
Severity: Medium
The MQ Appliance messaging server must produce log records containing information to establish what type of events occurred.
2
Rule
Severity: Medium
The WebSphere Liberty Server must log remote session and security activity.
1
Rule
Severity: Medium
The WebSphere Application Server audit event type filters must be configured.
1
Rule
Severity: Medium
CA VM:Secure product must be installed and operating.
2
Rule
Severity: Medium
The IDPS must produce audit records containing information to establish the outcome of events associated with detected harmful or potentially harmful traffic, including, at a minimum, capturing all associated communications traffic.
2
Rule
Severity: Low
The Sentry must produce audit records containing information to establish the outcome of the events.
4
Rule
Severity: Low
The Juniper router must be configured to log all packets that have been dropped.
2
Rule
Severity: Medium
The Mainframe Product must produce audit records containing information to establish the outcome of the events.
1
Rule
Severity: Medium
SQL Server must produce Trace or Audit records containing sufficient information to establish the outcome (success or failure) of the events.
2
Rule
Severity: Medium
The network device must produce audit records that contain information to establish the outcome of the event.
1
Rule
Severity: Medium
Nutanix AOS must produce audit records containing information to establish the outcome of events.
1
Rule
Severity: Medium
OHS must have a log format defined to produce log records that contain sufficient information to establish the outcome (success or failure) of events.
1
Rule
Severity: Medium
OHS must have a SSL log format defined to produce log records that contain sufficient information to establish the outcome (success or failure) of events.
1
Rule
Severity: Medium
OHS must have a log file defined for each site/virtual host to produce log records that contain sufficient information to establish the outcome (success or failure) of events.
1
Rule
Severity: Low
Oracle WebLogic must produce audit records that contain sufficient information to establish the outcome (success or failure) of application server and application events.
2
Rule
Severity: Medium
Prisma Cloud Compute must be configured for forensic data collection.
2
Rule
Severity: High
The Riverbed NetProfiler must be configured to automatically generate DOD-required audit records with sufficient information to support incident reporting to a central log server.
2
Rule
Severity: Low
The router must be configured to log all packets that have been dropped.
2
Rule
Severity: Medium
The SDN controller must be configured to produce audit records containing information to establish the outcome of the events.
1
Rule
Severity: Medium
Symantec ProxySG must produce audit records containing information to establish the outcome of the events.
1
Rule
Severity: Medium
The SMS must produce audit records containing information to establish the outcome of events associated with detected harmful or potentially harmful traffic, including, at a minimum, capturing all associated communications traffic by sending all audit and system logs to a centralized syslog server.
2
Rule
Severity: Medium
The UEM server must be configured to produce audit records that contain information to establish the outcome of the events.
1
Rule
Severity: High
The TippingPoint SMS must automatically generate audit records for account changes and actions with containing information needed for analysis of the event that occurred on the SMS and TPS.
1
Rule
Severity: Low
The NSX-T Tier-1 Gateway Firewall must generate traffic log entries containing information to establish the details of the event.
2
Rule
Severity: Medium
The VPN Gateway must produce log records containing information to establish the outcome of the events.
2
Rule
Severity: Medium
Audit records content must contain valid information to allow for proper incident reporting.
2
Rule
Severity: Medium
The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
2
Rule
Severity: Medium
AccessLogValve must be configured for each application context.
1
Rule
Severity: Medium
The macOS system must initiate session audits at system startup, using internal clocks with time stamps for audit records that meet a minimum granularity of one second and can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT), in order to generate audit records containing information to establish what type of events occurred, the identity of any individual or process associated with the event, including individual identities of group account users, establish where the events occurred, source of the event, and outcome of the events including all account enabling actions, full-text recording of privileged commands, and information about the use of encryption for access wireless access to and from the system.
3
Rule
Severity: Medium
The macOS system must produce audit records containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions.
3
Rule
Severity: Medium
The macOS system must enable security auditing.
4
Rule
Severity: Medium
PostgreSQL must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
3
Rule
Severity: Medium
The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
2
Rule
Severity: Medium
The Cisco ASA must be configured to produce audit records containing information to establish the outcome of events associated with detected harmful or potentially harmful traffic.
2
Rule
Severity: Medium
The Cisco ASA remote access VPN server must be configured to produce log records containing information to establish the outcome of the events.
2
Rule
Severity: Low
The Cisco router must be configured to log all packets that have been dropped at interfaces via an ACL.
2
Rule
Severity: Medium
The Cisco ASA must be configured to produce audit records that contain information to establish the outcome of the event.
2
Rule
Severity: Low
The Cisco switch must be configured to log all packets that have been dropped at interfaces via an access control list (ACL).
4
Rule
Severity: Low
The Cisco router must be configured to log all packets that have been dropped at interfaces via ACL.
4
Rule
Severity: Low
The Cisco switch must be configured to log all packets that have been dropped at interfaces via an ACL.
5
Rule
Severity: Medium
The DBMS must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
2
Rule
Severity: Medium
All audit records must generate the event results within the container platform.
2
Rule
Severity: Medium
The EDB Postgres Advanced Server must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
2
Rule
Severity: Medium
The operating system must produce audit records containing information to establish the outcome of the events.
2
Rule
Severity: Medium
SSMC web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
2
Rule
Severity: Medium
AIX must produce audit records containing information to establish the outcome of the events.
2
Rule
Severity: Medium
IBM z/OS Required SMF data record types must be collected.
4
Rule
Severity: Medium
IBM z/OS must specify SMF data options to assure appropriate activation.
2
Rule
Severity: Medium
IBM RACF SETROPTS LOGOPTIONS must be properly configured.
4
Rule
Severity: Medium
IBM z/OS required SMF data record types must be collected.
2
Rule
Severity: Medium
IBM z/OS must specify SMF data options to ensure appropriate activation.
2
Rule
Severity: Low
The ICS must be configured to generate log records containing sufficient information about where, when, identity, source, or outcome of the events.
2
Rule
Severity: Medium
The Juniper EX switch must be configured to produce audit records that contain information to establish the outcome of the event.
2
Rule
Severity: Medium
The ICS must be configured to audit the execution of privileged functions such as accounts additions and changes.
2
Rule
Severity: Medium
Kubernetes API Server must generate audit records that identify what type of event has occurred, identify the source of the event, contain the event results, identify any users, and identify any containers associated with the event.
2
Rule
Severity: Medium
MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.
2
Rule
Severity: Medium
The IIS 10.0 website must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 10.0 website events.
2
Rule
Severity: Medium
The IIS 10.0 web server must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 10.0 web server events.
2
Rule
Severity: Medium
PowerShell Transcription must be enabled on Windows 10.
2
Rule
Severity: Medium
PowerShell Transcription must be enabled on Windows 11.
2
Rule
Severity: Medium
Windows Server 2016 must have PowerShell Transcription enabled.
2
Rule
Severity: Medium
Windows Server 2019 must have PowerShell Transcription enabled.
2
Rule
Severity: Medium
Windows Server 2022 must have PowerShell Transcription enabled.
2
Rule
Severity: Medium
OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
2
Rule
Severity: Medium
The Palo Alto Networks security platform must capture traffic of detected/dropped malicious code.
2
Rule
Severity: Medium
The Automation Controller must generate the appropriate log records.
2
Rule
Severity: Medium
Rancher RKE2 components must be configured in accordance with the security configuration settings based on DOD security configuration or implementation guidance, including SRGs, STIGs, NSA configuration guides, CTOs, and DTMs.
2
Rule
Severity: Medium
All audit records must generate the event results within OpenShift.
4
Rule
Severity: Medium
SUSE operating system audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
2
Rule
Severity: Medium
RHEL 9 audit package must be installed.
2
Rule
Severity: Medium
RHEL 9 audit service must be enabled.
4
Rule
Severity: Medium
Audit records must include the outcome (success or failure) of the events that occurred.
2
Rule
Severity: Medium
The VMM must produce audit records containing information to establish the outcome of the events.
1
Rule
Severity: Medium
VAMI must produce log records containing sufficient information to establish what type of events occurred.
1
Rule
Severity: Medium
Performance Charts must record user access in a format that enables monitoring of remote access.
1
Rule
Severity: Medium
ESX Agent Manager must record user access in a format that enables monitoring of remote access.
1
Rule
Severity: Medium
Lookup Service must record user access in a format that enables monitoring of remote access.
1
Rule
Severity: Medium
The Photon operating system must configure auditd to log to disk.
3
Rule
Severity: Medium
The vCenter ESX Agent Manager service must produce log records containing sufficient information regarding event details.
1
Rule
Severity: Medium
VMware Postgres log files must contain required fields.
1
Rule
Severity: Medium
The Security Token Service must record user access in a format that enables monitoring of remote access.
3
Rule
Severity: Medium
The vCenter Lookup service must produce log records containing sufficient information regarding event details.
1
Rule
Severity: Medium
vSphere UI must record user access in a format that enables monitoring of remote access.
3
Rule
Severity: Medium
The vCenter Perfcharts service must produce log records containing sufficient information regarding event details.
3
Rule
Severity: Medium
The Photon operating system must enable the auditd service.
3
Rule
Severity: Medium
The vCenter PostgreSQL service must produce logs containing sufficient information to establish what type of events occurred.
3
Rule
Severity: Medium
The vCenter STS service must produce log records containing sufficient information regarding event details.
3
Rule
Severity: Medium
The vCenter UI service must produce log records containing sufficient information regarding event details.
3
Rule
Severity: Medium
The vCenter VAMI service must produce log records containing sufficient information to establish what type of events occurred.
2
Rule
Severity: Medium
The web server must produce log records that contain sufficient information to establish the outcome (success or failure) of events.
1
Rule
Severity: Medium
The EDB Postgres Advanced Server must generate audit records for DoD-defined auditable events.
1
Rule
Severity: Medium
Ubuntu 22.04 LTS must have the "auditd" package installed.
1
Rule
Severity: Medium
Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
1
Rule
Severity: Medium
The Enterprise Voice, Video, and Messaging Endpoint must be configured to produce session (call detail) records containing the outcome of the connection.
1
Rule
Severity: Medium
The F5 BIG-IP appliance must generate event log records that can be forwarded to the centralized events log.
1
Rule
Severity: Medium
The Enterprise Voice, Video, and Messaging Session Manager must produce session (call) records containing the outcome (status) of the connection.
1
Rule
Severity: Medium
The F5 BIG-IP appliance must generate traffic log entries containing information to establish the details of the event, including success or failure of the application of the firewall rule.
1
Rule
Severity: Medium
The F5 BIG-IP appliance must be configured to audit the execution of privileged functions such as accounts additions and changes.
1
Rule
Severity: Medium
MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.
1
Rule
Severity: Medium
The OL 8 audit package must be installed.
1
Rule
Severity: Medium
SLEM 5 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
1
Rule
Severity: Medium
The TPS must provide audit record generation capability for detection events based on implementation of policy filters, rules, signatures, and anomaly analysis.
1
Rule
Severity: High
The TippingPoint SMS must be configured to send log data to at least two central log servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).
1
Rule
Severity: Medium
TOSS audit records must contain information to establish what type of events occurred, when the events occurred, the source of events, where events occurred, and the outcome of events.
1
Rule
Severity: Info
The NSX Distributed Firewall must generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the NSX Distributed Firewall rule.
1
Rule
Severity: Medium
The NSX Tier-0 Gateway Firewall must generate traffic log entries.
Patternfly
PatternFly elements
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Modules