CCI-000135
Generate audit records containing the organization-defined additional information that is to be included in the audit records.
34 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
34 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
34 rules found Severity: Medium
33 rules found Severity: Medium
34 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
27 rules found Severity: Medium
28 rules found Severity: Medium
26 rules found Severity: Medium
7 rules found Severity: Medium
26 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
18 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
18 rules found Severity: Medium
18 rules found Severity: Medium
12 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
23 rules found Severity: Medium
19 rules found Severity: Medium
4 rules found Severity: Medium
20 rules found Severity: Medium
16 rules found Severity: Medium
10 rules found Severity: Medium
10 rules found Severity: Medium
18 rules found Severity: Medium
2 rules found Severity: Medium
3 rules found Severity: Medium
The Arista Multilayer Switch must generate audit records containing the full-text recording of privileged commands.
1 rule found Severity: Low
1 rule found Severity: Low
The audit log configuration level must be set to request in the Universal Control Plane (UCP) component of Docker Enterprise.
1 rule found Severity: Medium
The host operating systems auditing policies for the Docker Engine - Enterprise component of Docker Enterprise must be set.
1 rule found Severity: Medium
The FortiGate device must generate audit records containing the full-text recording of privileged commands.
1 rule found Severity: Medium
The HP FlexFabric Switch must generate audit records containing the full-text recording of privileged commands.
1 rule found Severity: Low
The HYCU Server must generate audit records containing the full-text recording of privileged commands.
1 rule found Severity: Medium
DB2 must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.
1 rule found Severity: Medium
The MQ Appliance messaging server must produce log records containing information to establish what type of events occurred.
1 rule found Severity: Medium
1 rule found Severity: Medium
SQL Server must include organization-defined additional, more detailed information in Trace or Audit records for events identified by type, location, or subject.
1 rule found Severity: Medium
Nutanix AOS must produce audit records containing the full-text recording of successful and unsuccessful attempts to execute the passwd/gpasswd/unix-chkpwd privileged commands.
1 rule found Severity: Medium
Nutanix AOS must produce audit records containing the full-text recording of successful and unsuccessful attempts to execute the chage privileged command.
1 rule found Severity: Medium
Nutanix AOS must produce audit records containing the full-text recording of successful and unsuccessful attempts to execute the userhelper privileged command.
1 rule found Severity: Medium
Nutanix AOS must produce audit records containing the full-text recording of successful and unsuccessful attempts to execute the mount and umount privileged commands.
1 rule found Severity: Medium
Nutanix AOS must produce audit records containing the full-text recording of successful and unsuccessful attempts to execute the post-related privileged commands.
1 rule found Severity: Medium
Nutanix AOS must produce audit records containing the full-text recording of successful and unsuccessful attempts to execute the opensshrelated privileged commands.
1 rule found Severity: Medium
Nutanix AOS must produce audit records containing the full-text recording of successful and unsuccessful attempts to execute the crontab-related privileged commands.
1 rule found Severity: Medium
1 rule found Severity: Medium
Riverbed Optimization System (RiOS) must generate audit records containing the full-text recording of privileged commands.
1 rule found Severity: Medium
The macOS system must initiate session audits at system startup, using internal clocks with time stamps for audit records that meet a minimum granularity of one second and can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT), in order to generate audit records containing information to establish what type of events occurred, the identity of any individual or process associated with the event, including individual identities of group account users, establish where the events occurred, source of the event, and outcome of the events including all account enabling actions, full-text recording of privileged commands, and information about the use of encryption for access wireless access to and from the system.
1 rule found Severity: Medium
The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
2 rules found Severity: Medium
MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.
2 rules found Severity: Medium
The DBMS must include organization-defined additional, more detailed information in the audit records for audit events identified by type, location, or subject.
2 rules found Severity: Medium
PostgreSQL must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.
3 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The Red Hat Enterprise Linux operating system must audit all uses of the sudoers file and all files in the /etc/sudoers.d/ directory.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The EDB Postgres Advanced Server must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.
2 rules found Severity: Medium
The macOS system must produce audit records containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Cisco ASA must be configured to generate audit records containing the full-text recording of privileged commands.
1 rule found Severity: Medium
The Cisco switch must be configured to generate audit records containing the full-text recording of privileged commands.
3 rules found Severity: Medium
The Cisco ISE must generate audit records containing the full-text recording of privileged commands.
1 rule found Severity: Medium
The F5 BIG-IP appliance must be configured to audit the execution of privileged functions such as accounts additions and changes.
1 rule found Severity: Medium
1 rule found Severity: Medium
The HPE 3PAR OS must provide automated mechanisms for supporting account management functions via AD.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Kubernetes API Server must generate audit records that identify what type of event has occurred, identify the source of the event, contain the event results, identify any users, and identify any containers associated with the event.
1 rule found Severity: Medium
MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.
1 rule found Severity: Medium
Azure SQL Database must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.
1 rule found Severity: Medium
The network device must generate audit records containing the full-text recording of privileged commands.
1 rule found Severity: Medium
The Oracle Linux operating system must be configured so that auditing is configured to produce records containing information to establish what type of events occurred, where the events occurred, the source of the events, and the outcome of the events. These audit records must also identify individual identities of group account users.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The MySQL Database Server 8.0 must include additional, more detailed, organizationally defined information in the audit records for audit events identified by type, location, or subject.
1 rule found Severity: Medium
The Riverbed NetProfiler must be configured to automatically generate DOD-required audit records with sufficient information to support incident reporting to a central log server.
1 rule found Severity: High
Rancher MCM must allocate audit record storage and generate audit records associated with events, users, and groups.
1 rule found Severity: Medium
SLEM 5 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The TippingPoint SMS must be configured to send log data to at least two central log servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).
1 rule found Severity: High
TOSS audit records must contain information to establish what type of events occurred, when the events occurred, the source of events, where events occurred, and the outcome of events.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Successful/unsuccessful uses of the "pam_timestamp_check" command in TOSS must generate an audit record.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
NixOS must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.
1 rule found Severity: Medium
1 rule found Severity: Medium
Successful/unsuccessful uses of the rename, unlink, rmdir, renameat, and unlinkat system calls in NixOS must generate an audit record.
1 rule found Severity: Medium
Successful/unsuccessful uses of the init_module, finit_module, and delete_module system calls in NixOS must generate an audit record.
1 rule found Severity: Medium
NixOS must generate an audit record for successful/unsuccessful modifications to the cron configuration.
1 rule found Severity: Medium
NixOS must generate an audit record for successful/unsuccessful uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
1 rule found Severity: Medium
Successful/unsuccessful uses of the chown, fchown, fchownat, and lchown system calls in NixOS must generate an audit record.
1 rule found Severity: Medium
Successful/unsuccessful uses of the chmod, fchmod, and fchmodat system calls in NixOS must generate an audit record.
1 rule found Severity: Medium
NixOS must generate audit records when successful/unsuccessful attempts to modify security objects occur.
1 rule found Severity: Medium
NixOS must generate audit records when concurrent logins to the same account occur from different sources.
1 rule found Severity: Medium
NixOS must generate audit records for all account creations, modifications, disabling, and termination events.
1 rule found Severity: Medium
The application server must generate log records containing the full-text recording of privileged commands or the individual identities of group account users.
1 rule found Severity: Medium
The application must generate audit records containing the full-text recording of privileged commands or the individual identities of group account users.
1 rule found Severity: Medium
1 rule found Severity: Medium
Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
1 rule found Severity: Medium
The Cisco router must be configured to generate audit records containing the full-text recording of privileged commands.
2 rules found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect the files within /etc/sudoers.d/
1 rule found Severity: Medium
The container platform must generate audit records containing the full-text recording of privileged commands or the individual identities of group account users.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.
1 rule found Severity: Medium
1 rule found Severity: Medium
AlmaLinux OS 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
AlmaLinux OS 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
AlmaLinux OS 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
1 rule found Severity: Medium
The DBMS must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.
1 rule found Severity: Medium
The operating system must generate audit records containing the full-text recording of privileged commands.
1 rule found Severity: Medium
The operating system must produce audit records containing the individual identities of group account users.
1 rule found Severity: Medium
The HYCU virtual appliance must generate audit records containing the full-text recording of privileged commands.
1 rule found Severity: Medium
2 rules found Severity: Medium
The Juniper router must be configured to generate audit records containing the full-text recording of privileged commands.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Juniper SRX Services Gateway must generate log records containing the full-text recording of privileged commands.
1 rule found Severity: Low
The Mainframe Product must generate audit records containing the full-text recording of privileged commands or the individual identities of group account users.
1 rule found Severity: Medium
MariaDB must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.
1 rule found Severity: Medium
SQL Server must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The configuration integrity of the container platform must be ensured and runtime policies must be configured.
1 rule found Severity: High
OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
1 rule found Severity: Medium
Rancher RKE2 components must be configured in accordance with the security configuration settings based on DOD security configuration or implementation guidance, including SRGs, STIGs, NSA configuration guides, CTOs, and DTMs.
1 rule found Severity: Medium
OpenShift must generate audit records for all DOD-defined auditable events within all components in the platform.
1 rule found Severity: Medium
1 rule found Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/security/opasswd".
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
1 rule found Severity: Medium
OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/".
1 rule found Severity: Medium
The OL 8 audit system must be configured to audit any use of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
OL 8 must generate audit records for any use of the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
OL 8 must generate audit records for any use of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls.
1 rule found Severity: Medium
OL 8 must generate audit records for any use of the "chown", "fchown", "fchownat", and "lchown" system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
OL 8 must allocate an "audit_backlog_limit" of sufficient size to capture processes that start prior to the audit daemon.
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
RHEL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
RHEL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
SUSE operating system audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
2 rules found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.
1 rule found Severity: Medium
The VMM must generate audit records containing the full-text recording of privileged commands or the individual identities of group account users.
1 rule found Severity: Medium
The UEM server must be configured to generate audit records containing the full-text recording of privileged commands or the individual identities of group account users.
1 rule found Severity: Medium
3 rules found Severity: Medium
The vCenter PostgreSQL service must produce logs containing sufficient information to establish what type of events occurred.
2 rules found Severity: Medium