Capacity
CCI-000139
Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.
27
Rule
Severity: Medium
Configure auditd mail_acct Action on Low Disk Space
12
Rule
Severity: Medium
Shutdown System When Auditing Failures Occur
29
Rule
Severity: Medium
Configure System to Forward All Mail For The Root Account
29
Rule
Severity: Medium
Configure System to Forward All Mail From Postmaster to The Root Account
1
Rule
Severity: Low
The A10 Networks ADC must send an alert to, at a minimum, the ISSO and SCA when connectivity to the Syslog servers is lost.
1
Rule
Severity: Low
The A10 Networks ADC must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
2
Rule
Severity: Medium
AAA Services must be configured to alert the SA and ISSO when any audit processing failure occurs.
2
Rule
Severity: Medium
The Apache web server must use a logging mechanism that is configured to alert the (ISSO) and System Administrator (SA) in the event of a processing failure.
2
Rule
Severity: Medium
The ALG must send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.
2
Rule
Severity: Medium
The application server must alert the SA and ISSO, at a minimum, in the event of a log processing failure.
2
Rule
Severity: Medium
The application must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
1
Rule
Severity: Low
Docker Enterprise must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
1
Rule
Severity: Medium
CounterACT must send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.
2
Rule
Severity: Medium
Forescout must configure TCP for the syslog protocol to allow for detection by the central event server if communications is lost. This is required for compliance with C2C Step 1.
1
Rule
Severity: Medium
SNMP must be changed from default settings and must be configured on the storage system to provide alerts of critical events that impact system security.
1
Rule
Severity: Medium
The DataPower Gateway must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
1
Rule
Severity: Medium
The DataPower Gateway must send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.
1
Rule
Severity: Medium
The MQ Appliance messaging server must alert the SA and ISSO, at a minimum, in the event of a log processing failure.
1
Rule
Severity: Medium
The MQ Appliance network device must alert the Information System Security Officer (ISSO) and System Administrator (SA) (at a minimum) in the event of an audit processing failure.
1
Rule
Severity: Low
The WebSphere Application Server must alert the SA and ISSO, at a minimum, in the event of a log processing failure.
1
Rule
Severity: Medium
The WebSphere Application Server audit subsystem failure action must be set to Log warning.
1
Rule
Severity: Medium
The Ivanti MobileIron Core server must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
2
Rule
Severity: Medium
The ISEC7 EMM Suite must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
2
Rule
Severity: Low
The Sentry must send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.
2
Rule
Severity: Medium
The Juniper SRX Services Gateway must generate an alert message to the management console and generate a log event record that can be forwarded to the ISSO and designated system administrators when the local accounts (i.e., the account of last resort or root account) are modified.
2
Rule
Severity: Medium
The Mainframe Product must alert the system administrator (SA) and information system security officer (ISSO) (at a minimum) in the event of an audit processing failure.
1
Rule
Severity: Medium
Nutanix AOS must be configured to send Cluster Check alerts to the SA and ISSO.
1
Rule
Severity: Low
Oracle WebLogic must provide a real-time alert when organization-defined audit failure events occur.
1
Rule
Severity: Low
Oracle WebLogic must alert designated individual organizational officials in the event of an audit processing failure.
1
Rule
Severity: Medium
Oracle WebLogic must provide system notifications to a list of response personnel who are identified by name and/or role.
1
Rule
Severity: Medium
Riverbed Optimization System (RiOS) must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
1
Rule
Severity: Medium
The SEL-2740S must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
2
Rule
Severity: Medium
Tanium must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
2
Rule
Severity: Medium
The Tanium application must alert the information system security officer and system administrator (at a minimum) in the event of an audit processing failure.
2
Rule
Severity: Medium
The Tanium application must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
2
Rule
Severity: Medium
The Tanium operating system (TanOS) must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
2
Rule
Severity: Medium
The UEM SRG must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
2
Rule
Severity: Medium
The Apache web server must use a logging mechanism that is configured to alert the Information System Security Officer (ISSO) and System Administrator (SA) in the event of a processing failure.
1
Rule
Severity: Medium
The application server must alert the SA and ISSO, at a minimum, in the event of a log processing failure.
3
Rule
Severity: Medium
The macOS system must configure audit capacity warning.
3
Rule
Severity: Medium
The Ubuntu operating system must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
2
Rule
Severity: Medium
The Cisco ISE must generate a critical alert to be sent to the ISSO and SA (at a minimum) if it is unable to communicate with the central event log. This is required for compliance with C2C Step 1.
2
Rule
Severity: Medium
The operating system must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
2
Rule
Severity: Medium
SSMC web server must use a logging mechanism that is configured to alert the ISSO and SA in the event of a processing failure.
2
Rule
Severity: Medium
The HPE 3PAR OS must be configured to send SNMP alerts to alert in the event of an audit processing failure.
2
Rule
Severity: Medium
AIX must be configured to generate an audit record when 75% of the audit file system is full.
6
Rule
Severity: Medium
IBM z/OS BUFUSEWARN in the SMFPRMxx must be properly set.
2
Rule
Severity: Medium
Both the log file and Event Tracing for Windows (ETW) for each IIS 10.0 website must be enabled.
2
Rule
Severity: Medium
Both the log file and Event Tracing for Windows (ETW) for the IIS 10.0 web server must be enabled.
2
Rule
Severity: Medium
The Oracle Linux operating system must shut down upon audit processing failure, unless availability is an overriding concern. If availability is a concern, the system must alert the designated staff (System Administrator [SA] and Information System Security Officer [ISSO] at a minimum) in the event of an audit processing failure.
2
Rule
Severity: Medium
The OL 8 System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.
2
Rule
Severity: Medium
The OL 8 Information System Security Officer (ISSO) and System Administrator (SA) (at a minimum) must have mail aliases to be notified of an audit processing failure.
2
Rule
Severity: Medium
Automation Controller must use external log providers that can collect user activity logs in independent, protected repositories to prevent modification or repudiation.
1
Rule
Severity: Medium
The Red Hat Enterprise Linux operating system must shut down upon audit processing failure, unless availability is an overriding concern. If availability is a concern, the system must alert the designated staff (System Administrator [SA] and Information System Security Officer [ISSO] at a minimum) in the event of an audit processing failure.
2
Rule
Severity: Medium
The RHEL 8 System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.
2
Rule
Severity: Medium
The RHEL 8 Information System Security Officer (ISSO) and System Administrator (SA) (at a minimum) must have mail aliases to be notified of an audit processing failure.
4
Rule
Severity: Medium
The Information System Security Officer (ISSO) and System Administrator (SA), at a minimum, must be alerted of a SUSE operating system audit processing failure event.
4
Rule
Severity: Medium
The Information System Security Officer (ISSO) and System Administrator (SA), at a minimum, must have mail aliases to be notified of a SUSE operating system audit processing failure.
2
Rule
Severity: Medium
RHEL 9 must forward mail from postmaster to the root account using a postfix alias.
2
Rule
Severity: Medium
RHEL 9 System Administrator (SA) and/or information system security officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.
2
Rule
Severity: Medium
RHEL 9 must have mail aliases to notify the information system security officer (ISSO) and system administrator (SA) (at a minimum) in the event of an audit processing failure.
2
Rule
Severity: Medium
RHEL 9 must take appropriate action when a critical audit processing failure occurs.
4
Rule
Severity: High
The operating system must alert designated organizational officials in the event of an audit processing failure.
2
Rule
Severity: Medium
The VMM must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
1
Rule
Severity: Medium
Lookup Service log files must be offloaded to a central log server in real time.
1
Rule
Severity: Medium
The Photon operating system audit log must log space limit problems to syslog.
1
Rule
Severity: Medium
vSphere UI log files must be moved to a permanent repository in accordance with site policy.
3
Rule
Severity: Medium
The Photon operating system must alert the ISSO and SA in the event of an audit processing failure.
2
Rule
Severity: Medium
The web server must use a logging mechanism that is configured to alert the ISSO and SA in the event of a processing failure.
1
Rule
Severity: Low
The BIG-IP appliance must be configured to alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
1
Rule
Severity: Medium
The application server must alert the system administrator (SA) and information system security offer (ISSO), at a minimum, in the event of a log processing failure.
1
Rule
Severity: Low
Ubuntu 22.04 LTS must alert the information system security officer (ISSO) and system administrator (SA) in the event of an audit processing failure.
1
Rule
Severity: Medium
The Dragos Platform must have notification and audit services installed.
1
Rule
Severity: Medium
The Enterprise Voice, Video, and Messaging Session Manager must alert the information system security officer (ISSO) and system administrator (SA) (at a minimum) in the event of a session (call) record system failure.
1
Rule
Severity: Medium
The ISEC7 SPHERE must alert the information system security officer (ISSO) and system administrator (SA) (at a minimum) in the event of an audit processing failure.
1
Rule
Severity: Medium
The Ivanti EPMM server must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
1
Rule
Severity: Medium
The information system security officer (ISSO) and system administrator (SA), at a minimum, must have mail aliases to be notified of a SLEM 5 audit processing failure.
1
Rule
Severity: Medium
The information system security officer (ISSO) and system administrator (SA), at a minimum, must be alerted of a SLEM 5 audit processing failure event.
1
Rule
Severity: Medium
TOSS must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
Patternfly
PatternFly elements
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Modules