Capacity
CCI-000158
Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.
29
Rule
Severity: Medium
Ensure the audit Subsystem is Installed
30
Rule
Severity: Medium
Enable auditd Service
3
Rule
Severity: Medium
Ensure the audit-libs package as a part of audit Subsystem is Installed
2
Rule
Severity: Medium
Ensure the libaudit1 package as a part of audit Subsystem is Installed
2
Rule
Severity: Medium
The application must provide the capability to filter audit records for events of interest based upon organization-defined criteria.
2
Rule
Severity: Low
The Central Log Server must be configured to perform on-demand filtering of the log records for events of interest based on organization-defined criteria.
1
Rule
Severity: Medium
The host operating systems auditing policies for the Docker Engine - Enterprise component of Docker Enterprise must be set.
2
Rule
Severity: Medium
The Mainframe Products must provide the capability to filter audit records for events of interest as defined in site security plan.
1
Rule
Severity: Medium
Nutanix AOS must provide the capability to centrally review and analyze audit records from multiple components within the system.
1
Rule
Severity: Medium
The Tanium Connect module must be configured to forward Tanium IOC Detect events to identified destinations.
1
Rule
Severity: Medium
The Tanium Connect module must be configured to forward Tanium Detect events to identified destinations.
2
Rule
Severity: Medium
The Tanium applications must provide the capability to filter audit records for events of interest based upon organization-defined criteria.
2
Rule
Severity: Medium
The Tanium applications must be configured to filter audit records for events of interest based on organization-defined criteria.
1
Rule
Severity: Medium
The macOS system must enable System Integrity Protection.
3
Rule
Severity: High
The macOS system must enable System Integrity Protection.
3
Rule
Severity: High
The macOS system must ensure System Integrity Protection is enabled.
3
Rule
Severity: Medium
The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
2
Rule
Severity: Medium
The operating system must provide the capability to filter audit records for events of interest based upon all audit fields within audit records.
2
Rule
Severity: Medium
AIX must provide the function to filter audit records for events of interest based upon all audit fields within audit records, support on-demand reporting requirements, and an audit reduction function that supports on-demand audit review and analysis and after-the-fact investigations of security incidents.
2
Rule
Severity: Medium
OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
4
Rule
Severity: Medium
SUSE operating system audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
2
Rule
Severity: Medium
RHEL 9 audit package must be installed.
2
Rule
Severity: Medium
RHEL 9 audit service must be enabled.
4
Rule
Severity: Medium
The operating system must provide the capability to automatically process audit records for events of interest based upon selectable, event criteria.
2
Rule
Severity: Medium
The VMM must support the capability to filter audit records for events of interest based upon all audit fields within audit records.
1
Rule
Severity: Medium
Ubuntu 22.04 LTS must have the "auditd" package installed.
1
Rule
Severity: Medium
Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
1
Rule
Severity: Low
The Central Log Server must be configured to perform on-demand sorting of log records for events of interest based on the content of organization-defined audit fields within log records.
1
Rule
Severity: Low
The Central Log Server must be configured to perform on-demand searches of log records for events of interest based on the content of organization-defined audit fields within log records.
1
Rule
Severity: Medium
The OL 8 audit package must be installed.
1
Rule
Severity: Medium
SLEM 5 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
Patternfly
PatternFly elements
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Modules