Capacity
CCI-000169
Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
29
Rule
Severity: Medium
Ensure the audit Subsystem is Installed
30
Rule
Severity: Medium
Enable auditd Service
29
Rule
Severity: Medium
Ensure auditd Collects Information on Exporting to Media (successful)
29
Rule
Severity: Medium
Ensure auditd Collects System Administrator Actions
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - chmod
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - chown
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fchmod
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fchmodat
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fchown
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fchownat
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fremovexattr
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fsetxattr
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - lchown
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - lremovexattr
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - lsetxattr
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - removexattr
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - setxattr
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - umount
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - umount2
29
Rule
Severity: Medium
Ensure auditd Collects File Deletion Events by User - rename
29
Rule
Severity: Medium
Ensure auditd Collects File Deletion Events by User - renameat
29
Rule
Severity: Medium
Ensure auditd Collects File Deletion Events by User - rmdir
29
Rule
Severity: Medium
Ensure auditd Collects File Deletion Events by User - unlink
29
Rule
Severity: Medium
Ensure auditd Collects File Deletion Events by User - unlinkat
23
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - creat
23
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - ftruncate
23
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - open
24
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - open_by_handle_at
23
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - openat
23
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - truncate
22
Rule
Severity: Medium
Ensure auditd Collects Information on Kernel Module Unloading - delete_module
23
Rule
Severity: Medium
Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
22
Rule
Severity: Medium
Ensure auditd Collects Information on Kernel Module Loading - init_module
30
Rule
Severity: Medium
Record attempts to alter time through adjtimex
3
Rule
Severity: Medium
Ensure the audit-libs package as a part of audit Subsystem is Installed
30
Rule
Severity: Medium
Record Attempts to Alter Time Through clock_settime
30
Rule
Severity: Medium
Record attempts to alter time through settimeofday
29
Rule
Severity: Medium
Record Attempts to Alter Time Through stime
29
Rule
Severity: Medium
Record Attempts to Alter the localtime File
19
Rule
Severity: Low
Enable Auditing for Processes Which Start Prior to the Audit Daemon
17
Rule
Severity: Low
Extend Audit Backlog Limit for the Audit Daemon
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/group
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/gshadow
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/security/opasswd
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/passwd
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/shadow
17
Rule
Severity: Medium
Record Any Attempts to Run chcon
14
Rule
Severity: Medium
Record Any Attempts to Run semanage
13
Rule
Severity: Medium
Record Any Attempts to Run setfiles
14
Rule
Severity: Medium
Record Any Attempts to Run setsebool
23
Rule
Severity: Medium
Record Attempts to Alter Logon and Logout Events - lastlog
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - chage
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - chsh
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - crontab
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd
9
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - insmod
14
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - kmod
9
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - modprobe
16
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - mount
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - newgrp
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - passwd
16
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - postdrop
16
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - postqueue
9
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - rmmod
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - su
18
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - sudo
16
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - umount
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
14
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - userhelper
8
Rule
Severity: Medium
Ensure auditd Collects System Administrator Actions - /etc/sudoers
7
Rule
Severity: Medium
Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/
14
Rule
Severity: Medium
Record Any Attempts to Run chacl
11
Rule
Severity: Medium
Record Any Attempts to Run setfacl
11
Rule
Severity: Medium
Record Any Attempts to Run ssh-agent
8
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - unix_update
14
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - usermod
8
Rule
Severity: Low
Log USBGuard daemon audit events using Linux Audit
2
Rule
Severity: Medium
Ensure the libaudit1 package as a part of audit Subsystem is Installed
2
Rule
Severity: Medium
Record Any Attempts to Run chmod
2
Rule
Severity: Medium
Record Any Attempts to Run rm
4
Rule
Severity: Medium
Record Attempts to Alter Logon and Logout Events - faillog
4
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - chfn
2
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - passmass
1
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - unix2_chkpwd
2
Rule
Severity: Medium
AAA Services must be configured to audit each authentication and authorization transaction.
1
Rule
Severity: Low
The Akamai Luna Portal must provide audit record generation capability for DoD-defined auditable events within the network device.
4
Rule
Severity: Medium
The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
2
Rule
Severity: Medium
The application server must generate log records for access and authentication events.
2
Rule
Severity: Medium
The Arista network device must be configured to capture all DOD auditable events.
2
Rule
Severity: Medium
The application must provide audit record generation capability for the creation of session IDs.
2
Rule
Severity: Medium
The application must provide audit record generation capability for the destruction of session IDs.
2
Rule
Severity: Medium
The application must provide audit record generation capability for the renewal of session IDs.
2
Rule
Severity: Medium
The application must not write sensitive data into the application logs.
2
Rule
Severity: Medium
The application must provide audit record generation capability for session timeouts.
2
Rule
Severity: Medium
The application must record a time stamp indicating when the event occurred.
2
Rule
Severity: Medium
The application must provide audit record generation capability for HTTP headers including User-Agent, Referer, GET, and POST.
2
Rule
Severity: Medium
The application must provide audit record generation capability for connecting system IP addresses.
2
Rule
Severity: Medium
The application must record the username or user ID of the user associated with the event.
2
Rule
Severity: Low
A BIND 9.x server implementation must be configured to allow DNS administrators to audit all DNS server components, based on selectable event criteria, and produce audit records within all DNS server components that contain information for failed security verification tests, information to establish the outcome and source of the events, any information necessary to determine cause of failure, and any information necessary to return to operations with least disruption to mission processes.
2
Rule
Severity: Low
The BIND 9.x server logging configuration must be configured to generate audit records for all DoD-defined auditable events to a local file by enabling triggers for all events with a severity of info, notice, warning, error, and critical for all DNS components.
2
Rule
Severity: High
IDMS must use the ESM to generate auditable records for resources when DoD-defined auditable events occur.
2
Rule
Severity: High
IDMS must use the ESM to generate auditable records for commands and utilities when DoD-defined auditable events occur.
2
Rule
Severity: Medium
The Central Log Server must be configured to retain the DoD-defined attributes of the log records sent by the devices and hosts.
1
Rule
Severity: Medium
The DBN-6300 must generate log events for detection events based on anomaly analysis.
1
Rule
Severity: Medium
The DBN-6300 must provide audit record generation capability for DoD-defined auditable events within the DBN-6300.
1
Rule
Severity: Medium
The audit log configuration level must be set to request in the Universal Control Plane (UCP) component of Docker Enterprise.
1
Rule
Severity: Medium
The host operating systems auditing policies for the Docker Engine - Enterprise component of Docker Enterprise must be set.
4
Rule
Severity: Medium
The DNS server implementation must be configured to provide audit record generation capability for DoD-defined auditable events within all DNS server components.
1
Rule
Severity: Medium
The FortiGate device must generate log records for a locally developed list of auditable events.
2
Rule
Severity: Medium
Forescout must generate log records for a locally developed list of auditable events.
2
Rule
Severity: Medium
Google Android 12 must be configured to generate audit records for the following auditable events: detected integrity violations.
4
Rule
Severity: Medium
Google Android 13 must be configured to generate audit records for the following auditable events: Detected integrity violations.
1
Rule
Severity: Low
The HP FlexFabric Switch must provide audit record generation capability for DoD-defined auditable events within the HP FlexFabric Switch.
1
Rule
Severity: Medium
The HYCU server must generate audit records for privileged activities or other system-level access.
1
Rule
Severity: Medium
The DataPower Gateway must provide audit record generation capability for DoD-defined auditable events within DataPower.
1
Rule
Severity: Medium
DB2 must provide audit record generation capability for DoD-defined auditable events within all DBMS/database components.
1
Rule
Severity: Medium
The MQ Appliance messaging server must generate log records for access and authentication events.
2
Rule
Severity: Medium
The WebSphere Liberty Server must log remote session and security activity.
1
Rule
Severity: Low
The MaaS360 MDM server must be configured to enable all required audit events (if function is not automatically implemented during MDM/MAS server install): a. Failure to push a new application on a managed mobile device.
1
Rule
Severity: Low
The MaaS360 server must be configured to enable all required audit events (if function is not automatically implemented during MDM/MAS server install): b. Failure to update an existing application on a managed mobile device.
1
Rule
Severity: Medium
The MaaS360 MDM Agent must be configured to implement the management setting: periodicity of reachability events equals six hours or less.
2
Rule
Severity: High
The ESCON Director Application Console Event log must be enabled.
2
Rule
Severity: Medium
The Hardware Management Console Event log must be active.
1
Rule
Severity: Medium
The WebSphere Application Server audit event type filters must be configured.
1
Rule
Severity: Medium
CA VM:Secure product must be installed and operating.
2
Rule
Severity: Medium
The IDPS must provide audit record generation capability for events where communication traffic is blocked or restricted based on policy filters, rules, signatures, and anomaly analysis.
2
Rule
Severity: Medium
The IDPS must provide audit record generation capability for detection events based on implementation of policy filters, rules, signatures, and anomaly analysis.
2
Rule
Severity: Medium
The IDPS must provide audit record generation with a configurable severity and escalation level capability.
2
Rule
Severity: Medium
The JBoss server must generate log records for access and authentication events to the management interface.
2
Rule
Severity: Medium
The Juniper router must be configured to generate log records for a locally developed list of auditable events.
2
Rule
Severity: Medium
The Juniper Networks SRX Series Gateway IDPS must provide audit record generation capability for detecting events based on implementation of policy filters, rules, and signatures.
2
Rule
Severity: Medium
The Juniper Networks SRX Series Gateway IDPS must provide audit record generation with a configurable severity and escalation level capability.
2
Rule
Severity: Medium
The Juniper SRX Services Gateway must automatically terminate a network administrator session after organization-defined conditions or trigger events requiring session disconnect.
2
Rule
Severity: Medium
The Mainframe Product must provide audit record generation capability for DoD-defined auditable events within all application components.
2
Rule
Severity: Medium
Microsoft Android 11 must be configured to generate audit records for the following auditable events: Detected integrity violations.
1
Rule
Severity: Low
Motorola Solutions Android 11 must be configured to generate audit records for the following auditable events: Detected integrity violations.
2
Rule
Severity: Medium
The Azure SQL Database must be configured to generate audit records for DOD-defined auditable events within all DBMS/database components.
1
Rule
Severity: Medium
Exchange Email Diagnostic log level must be set to lowest level.
1
Rule
Severity: Low
Exchange must have Audit record parameters set.
2
Rule
Severity: Medium
The Exchange email Diagnostic log level must be set to the lowest level.
4
Rule
Severity: Medium
Exchange Connectivity logging must be enabled.
2
Rule
Severity: Medium
The Exchange Email Diagnostic log level must be set to the lowest level.
2
Rule
Severity: Low
Exchange Audit record parameters must be set.
1
Rule
Severity: Medium
SQL Server must generate Trace or Audit records for organization-defined auditable events.
1
Rule
Severity: Medium
The Windows 2012 DNS Server log must be enabled.
1
Rule
Severity: Medium
The Windows 2012 DNS Server logging must be enabled to record events from all DNS server functions.
2
Rule
Severity: Medium
The network device must generate log records for a locally developed list of auditable events
1
Rule
Severity: Medium
Nutanix AOS must provide audit record generation capability for DoD-defined auditable events for successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels).
1
Rule
Severity: Medium
Nutanix AOS must provide audit record generation capability for DoD-defined auditable events for system and account management actions.
1
Rule
Severity: Medium
Nutanix AOS must provide audit record generation capability for DoD-defined auditable events for file attribute management actions.
1
Rule
Severity: Medium
Nutanix AOS must provide audit record generation capability for DoD-defined auditable events for system module management actions.
1
Rule
Severity: Medium
Nutanix AOS must provide audit record generation capability for DoD-defined auditable events for directory and permissions management actions.
1
Rule
Severity: Medium
Nutanix AOS must provide audit record generation capability for DoD-defined auditable events for file management actions.
1
Rule
Severity: Medium
Nutanix AOS must provide audit record generation capability for DoD-defined auditable events for all account creations, modifications, disabling, and terminations.
1
Rule
Severity: Medium
Nutanix AOS must be configured to audit the loading and unloading of dynamic kernel modules.
1
Rule
Severity: Medium
OHS must have the client requests logging module loaded to generate log records for system startup and shutdown, system access, and system authentication logging.
1
Rule
Severity: Medium
OHS must have OraLogMode set to Oracle Diagnostic Logging text mode to generate log records for system startup and shutdown, system access, and system authentication logging.
1
Rule
Severity: Medium
OHS must have a log directory location defined to generate log records for system startup and shutdown, system access, and system authentication logging.
1
Rule
Severity: Medium
OHS must have a log level severity defined to generate adequate log records for system startup and shutdown, system access, and system authentication events.
1
Rule
Severity: Medium
OHS must have the log rotation parameter set to allow for the generation log records for system startup and shutdown, system access, and system authentication events.
1
Rule
Severity: Medium
OHS must have a log format defined to generate adequate logs by system startup and shutdown, system access, and system authentication events.
1
Rule
Severity: Medium
OHS must have a SSL log format defined to generate adequate logs by system startup and shutdown, system access, and system authentication events.
1
Rule
Severity: Medium
OHS must have a log file defined for each site/virtual host to capture logs generated by system startup and shutdown, system access, and system authentication events.
2
Rule
Severity: Medium
Rancher MCM must generate audit records for all DoD-defined auditable events within all components in the platform.
1
Rule
Severity: Medium
Riverbed Optimization System (RiOS) must provide audit record generation capability for DoD-defined auditable events within the network device.
1
Rule
Severity: Medium
Symantec ProxySG must enable event access logging.
2
Rule
Severity: Medium
The TPS must provide audit record generation capability for detection events based on implementation of policy filters, rules, signatures, and anomaly analysis.
2
Rule
Severity: Medium
The TPS must provide audit record generation capability for events where communication traffic is blocked or restricted based on policy filters, rules, signatures, and anomaly analysis.
2
Rule
Severity: Medium
The Tanium operating system (TanOS) must offload audit records onto a different system or media than the system being audited.
2
Rule
Severity: Medium
The UEM Agent must provide an alert via the trusted channel to the UEM Server in the event of any of the following audit events:
-successful application of policies to a mobile device
-receiving or generating periodic reachability events
-change in enrollment state
-failure to install an application from the UEM Server
-failure to update an application from the UEM Server.
2
Rule
Severity: Medium
The UEM Agent must generate a UEM Agent audit record of the following auditable events:-startup and shutdown of the UEM Agent-UEM policy updated-any modification commanded by the UEM Server.
2
Rule
Severity: Medium
The UEM Agent must be configured to enable the following function: read audit logs of the managed endpoint device.
2
Rule
Severity: Medium
The UEM server must provide audit record generation capability for DoD-defined auditable events within all application components.
2
Rule
Severity: Medium
The UEM server must be configured to provide audit records in a manner suitable for the Authorized Administrators to interpret the information.
1
Rule
Severity: High
The TippingPoint SMS must automatically generate audit records for account changes and actions with containing information needed for analysis of the event that occurred on the SMS and TPS.
1
Rule
Severity: Medium
The NSX-T Manager must generate log records for the info level to capture the DoD-required auditable events.
1
Rule
Severity: Medium
The Horizon Connection Server must be configured with an events database.
2
Rule
Severity: Medium
AccessLogValve must be configured for each application context.
2
Rule
Severity: Medium
Tomcat servers behind a proxy or load balancer must log client IP.
1
Rule
Severity: Medium
The macOS system must enable System Integrity Protection.
3
Rule
Severity: High
The macOS system must enable System Integrity Protection.
3
Rule
Severity: High
The macOS system must ensure System Integrity Protection is enabled.
3
Rule
Severity: Medium
The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
2
Rule
Severity: Medium
The Cisco ASA must be configured to log events based on policy access control rules, signatures, and anomaly analysis.
2
Rule
Severity: Medium
The Cisco ASA must be configured to send log records to the syslog server for specific facility and severity level.
2
Rule
Severity: Medium
PostgreSQL must be configured to provide audit record generation for DoD-defined auditable events within all DBMS/database components.
2
Rule
Severity: Medium
The Cisco ISE must generate log records for a locally developed list of auditable events.
2
Rule
Severity: Medium
The DBMS must provide audit record generation capability for DoD-defined auditable events within all DBMS/database components.
2
Rule
Severity: Medium
The container platform must generate audit records for all DoD-defined auditable events within all components in the platform.
2
Rule
Severity: Medium
The EDB Postgres Advanced Server must provide audit record generation capability for DOD-defined auditable events within all EDB Postgres Advanced Server/database components.
2
Rule
Severity: Medium
Extensions installation must be blocklisted by default.
2
Rule
Severity: Medium
Deletion of browser history must be disabled.
2
Rule
Severity: Medium
Prompt for download location must be enabled.
2
Rule
Severity: Medium
Download restrictions must be configured.
2
Rule
Severity: Medium
Chrome Cleanup must be disabled.
2
Rule
Severity: Medium
Chrome Cleanup reporting must be disabled.
4
Rule
Severity: Medium
Google Android 14 must be configured to generate audit records for the following auditable events: Detected integrity violations.
2
Rule
Severity: Medium
The operating system must provide audit record generation capability for DoD-defined auditable events for all operating system components.
2
Rule
Severity: Low
SSMC must provide audit record generation capability for DOD-defined auditable events for all operating system components.
2
Rule
Severity: Medium
SSMC web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
2
Rule
Severity: Medium
AIX must provide audit record generation functionality for DoD-defined auditable events.
2
Rule
Severity: Medium
The Juniper EX switch must be configured to generate log records for a locally developed list of auditable events.
2
Rule
Severity: Medium
MarkLogic Server must be configured to provide audit record generation capability for DoD-defined auditable events within all DBMS/database components.
2
Rule
Severity: Medium
MariaDB must provide audit record generation capability for DoD-defined auditable events within all DBMS/database components.
4
Rule
Severity: Medium
Exchange connectivity logging must be enabled.
4
Rule
Severity: Medium
The Exchange email diagnostic log level must be set to the lowest level.
2
Rule
Severity: Low
Exchange audit record parameters must be set.
1
Rule
Severity: Medium
Configuring History setting must be set to 40 days.
1
Rule
Severity: Medium
Browser must retain history on exit.
1
Rule
Severity: Medium
Deleting websites that the user has visited must be disallowed.
2
Rule
Severity: Medium
SQL Server must be configured to generate audit records for DoD-defined auditable events within all DBMS/database components.
6
Rule
Severity: Medium
Audit policy using subcategories must be enabled.
2
Rule
Severity: Medium
Windows Server 2019 must force audit policy subcategory settings to override audit policy category settings.
2
Rule
Severity: Medium
Windows Server 2022 must force audit policy subcategory settings to override audit policy category settings.
2
Rule
Severity: Medium
OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
3
Rule
Severity: Medium
The DBMS must provide audit record generation capability for organization-defined auditable events within the database.
1
Rule
Severity: Medium
PostgreSQL must provide audit record generation capability for DoD-defined auditable events within all DBMS/database components.
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/shadow".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/security/opasswd".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/passwd".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/gshadow".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/group".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/".
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "su" command.
2
Rule
Severity: Medium
The OL 8 audit system must be configured to audit any use of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "chage" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any uses of the "chcon" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "ssh-agent" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "passwd" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "mount" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "umount" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "mount" syscall.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "unix_update" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "postdrop" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "postqueue" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "semanage" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "setfiles" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "userhelper" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "setsebool" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "unix_chkpwd" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "ssh-keysign" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "setfacl" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "pam_timestamp_check" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "newgrp" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "init_module" and "finit_module" system calls.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "gpasswd" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the delete_module syscall.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "crontab" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "chsh" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "chown", "fchown", "fchownat", and "lchown" system calls.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "chmod", "fchmod", and "fchmodat" system calls.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "sudo" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "usermod" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "chacl" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any use of the "kmod" command.
2
Rule
Severity: Medium
OL 8 must generate audit records for any attempted modifications to the "faillock" log file.
2
Rule
Severity: Medium
OL 8 must generate audit records for any attempted modifications to the "lastlog" file.
2
Rule
Severity: Medium
OL 8 must enable auditing of processes that start prior to the audit daemon.
2
Rule
Severity: Low
OL 8 must allocate an "audit_backlog_limit" of sufficient size to capture processes that start prior to the audit daemon.
2
Rule
Severity: Medium
The MySQL Database Server 8.0 must be configured to provide audit record generation capability for DoD-defined auditable events within all database components.
2
Rule
Severity: Medium
Redis Enterprise DBMS must provide audit record generation capability for DoD-defined auditable events within all DBMS/database components.
2
Rule
Severity: Medium
Redis Enterprise DBMS must generate audit records for DoD-defined auditable events within all DBMS/database components.
2
Rule
Severity: Medium
OpenShift must generate audit records for all DOD-defined auditable events within all components in the platform.
2
Rule
Severity: Medium
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
2
Rule
Severity: Medium
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
2
Rule
Severity: Medium
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
2
Rule
Severity: Medium
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
2
Rule
Severity: Medium
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
2
Rule
Severity: Medium
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
2
Rule
Severity: Medium
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/.
2
Rule
Severity: Medium
The RHEL 8 audit package must be installed.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the su command in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
The RHEL 8 audit system must be configured to audit any usage of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the chage command in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the chcon command in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the ssh-agent in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the passwd command in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the mount command in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the umount command in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the mount syscall in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the unix_update in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of postdrop in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of postqueue in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of semanage in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of setfiles in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of userhelper in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of setsebool in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of unix_chkpwd in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the ssh-keysign in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the setfacl command in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the pam_timestamp_check command in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the newgrp command in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the init_module and finit_module system calls in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the rename, unlink, rmdir, renameat, and unlinkat system calls in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the gpasswd command in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the delete_module command in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the crontab command in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the chsh command in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the chown, fchown, fchownat, and lchown system calls in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the chmod, fchmod, and fchmodat system calls in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the sudo command in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the usermod command in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the chacl command in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the kmod command in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful modifications to the faillock log file in RHEL 8 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful modifications to the lastlog file in RHEL 8 must generate an audit record.
2
Rule
Severity: Low
RHEL 8 must enable auditing of processes that start prior to the audit daemon.
2
Rule
Severity: Low
RHEL 8 must enable Linux audit logging for the USBGuard daemon.
2
Rule
Severity: Medium
RHEL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
2
Rule
Severity: Low
RHEL 9 must enable auditing of processes that start prior to the audit daemon.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the su command.
4
Rule
Severity: Low
The SUSE operating system must generate audit records for all uses of the sudo command.
4
Rule
Severity: Low
The SUSE operating system must generate audit records for all uses of the chfn command.
2
Rule
Severity: Low
The SUSE operating system must generate audit records for all uses of the mount command.
2
Rule
Severity: Low
The SUSE operating system must generate audit records for all uses of the umount command.
4
Rule
Severity: Low
The SUSE operating system must generate audit records for all uses of the ssh-agent command.
4
Rule
Severity: Low
The SUSE operating system must generate audit records for all uses of the ssh-keysign command.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the kmod command.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr syscalls.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the chown, fchown, fchownat, and lchown syscalls.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the chmod, fchmod, and fchmodat system calls.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate syscalls.
2
Rule
Severity: Low
The SUSE operating system must generate audit records for all uses of the passwd command.
4
Rule
Severity: Low
The SUSE operating system must generate audit records for all uses of the gpasswd command.
4
Rule
Severity: Low
The SUSE operating system must generate audit records for all uses of the newgrp command.
4
Rule
Severity: Low
The SUSE operating system must generate audit records for a uses of the chsh command.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the chmod command.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the setfacl command.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the chacl command.
2
Rule
Severity: Medium
Successful/unsuccessful attempts to modify categories of information (e.g., classification levels) must generate audit records.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the rm command.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all modifications to the tallylog file must generate an audit record.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all modifications to the lastlog file.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the passmass command.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the unix_chkpwd command.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the chage command.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the usermod command.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the crontab command.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the pam_timestamp_check command.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the delete_module command.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the init_module and finit_module syscalls.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all modifications to the faillog file.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the unlink, unlinkat, rename, renameat and rmdir syscalls.
2
Rule
Severity: Low
RHEL 9 must enable Linux audit logging for the USBGuard daemon.
2
Rule
Severity: Medium
RHEL 9 audit package must be installed.
2
Rule
Severity: Medium
RHEL 9 audit service must be enabled.
2
Rule
Severity: Medium
RHEL 9 audit system must audit local events.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the chmod, fchmod, and fchmodat system calls.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the chown, fchown, fchownat, and lchown system calls.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of umount system calls.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the chacl command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the setfacl command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the chcon command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the semanage command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the setfiles command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the setsebool command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the delete_module system call.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the init_module and finit_module system calls.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the chage command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the chsh command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the crontab command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the gpasswd command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the kmod command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the newgrp command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the pam_timestamp_check command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the passwd command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the postdrop command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the postqueue command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the ssh-agent command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the ssh-keysign command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the su command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the sudo command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the sudoedit command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the unix_chkpwd command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the unix_update command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the userhelper command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the usermod command.
2
Rule
Severity: Medium
RHEL 9 must audit all uses of the mount command.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the umount system call in RHEL 9 must generate an audit record.
2
Rule
Severity: Medium
Successful/unsuccessful uses of the umount2 system call in RHEL 9 must generate an audit record.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the passwd command.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the unix_chkpwd or unix2_chkpwd commands.
2
Rule
Severity: Medium
The SUSE operating system must audit all uses of the sudoers file and all files in the /etc/sudoers.d/ directory.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate system calls.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the chown, fchown, fchownat, and lchown system calls.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the sudoedit command.
2
Rule
Severity: Low
The SUSE operating system must generate audit records for all uses of the mount system call.
2
Rule
Severity: Low
The SUSE operating system must generate audit records for all uses of the umount system call.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the insmod command.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the rmmod command.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the modprobe command.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the chcon command.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the delete_module system call.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all uses of the init_module and finit_module system calls.
4
Rule
Severity: Medium
The audit records must provide data for all auditable events defined at the organizational level for the organization-defined information system components.
4
Rule
Severity: Medium
The operating system must support the capability to compile audit records from multiple components within the system into a system-wide (logical or physical) audit trail that is time-correlated to within organization-defined level of tolerance.
4
Rule
Severity: Medium
The audit system must be configured to audit all discretionary access control permission modifications.
4
Rule
Severity: Medium
The audit system must be configured to audit the loading and unloading of dynamic kernel modules.
2
Rule
Severity: Medium
Splunk Enterprise must be configured to retain the DoD-defined attributes of the log records sent by the devices and hosts.
2
Rule
Severity: Medium
The VMM must provide audit record generation capability for DoD-defined auditable events for all VMM components.
1
Rule
Severity: Medium
VAMI must generate log records for system startup and shutdown.
1
Rule
Severity: Medium
Performance Charts must record user access in a format that enables monitoring of remote access.
1
Rule
Severity: Medium
Performance Charts must generate log records for system startup and shutdown.
1
Rule
Severity: Medium
ESX Agent Manager must record user access in a format that enables monitoring of remote access.
1
Rule
Severity: Medium
ESX Agent Manager must generate log records for system startup and shutdown.
1
Rule
Severity: Medium
Lookup Service must generate log records for system startup and shutdown.
1
Rule
Severity: Medium
The Photon operating system must have the auditd service running.
3
Rule
Severity: Medium
The vCenter ESX Agent Manager service must produce log records containing sufficient information regarding event details.
1
Rule
Severity: Medium
VMware Postgres log files must contain required fields.
1
Rule
Severity: Medium
The Security Token Service must generate log records during Java startup and shutdown.
3
Rule
Severity: Medium
The vCenter Lookup service must produce log records containing sufficient information regarding event details.
1
Rule
Severity: Medium
vSphere UI must record user access in a format that enables monitoring of remote access.
1
Rule
Severity: Medium
vSphere UI must generate log records for system startup and shutdown.
3
Rule
Severity: Medium
The vCenter Perfcharts service must produce log records containing sufficient information regarding event details.
3
Rule
Severity: Medium
The Photon operating system must enable the auditd service.
3
Rule
Severity: Medium
The vCenter PostgreSQL service must enable "pgaudit" to provide audit record generation capabilities.
3
Rule
Severity: Medium
The vCenter STS service must produce log records containing sufficient information regarding event details.
3
Rule
Severity: Medium
The vCenter UI service must produce log records containing sufficient information regarding event details.
2
Rule
Severity: Medium
The web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
1
Rule
Severity: Low
Zebra Android 11 must be configured to generate audit records for the following auditable events: Detected integrity violations.
2
Rule
Severity: Medium
The Windows DNS Server log must be enabled.
1
Rule
Severity: Medium
The EDB Postgres Advanced Server must be configured to provide audit record generation capability for DoD-defined auditable events within all EDB Postgres Advanced Server/database components.
1
Rule
Severity: Medium
Ubuntu 22.04 LTS must have the "auditd" package installed.
1
Rule
Severity: Medium
Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
1
Rule
Severity: Medium
PostgreSQL must provide audit record generation capability for DOD-defined auditable events within all DBMS/database components.
1
Rule
Severity: Medium
The Enterprise Voice, Video, and Messaging Endpoint must be configured to provide session (call detail) record generation capability.
1
Rule
Severity: Medium
The Enterprise Voice, Video, and Messaging Session Manager must produce session (call) records for events determined to be significant and relevant by local policy.
1
Rule
Severity: Medium
The F5 BIG-IP appliance must be configured to audit the execution of privileged functions such as accounts additions and changes.
2
Rule
Severity: Medium
Google Android 15 must be configured to generate audit records for the following auditable events: Detected integrity violations.
1
Rule
Severity: Medium
Audit logging must be enabled on MKE.
1
Rule
Severity: Medium
MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.
1
Rule
Severity: Medium
The OL 8 audit package must be installed.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "chacl" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "chage" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "chcon" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "chfn" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "chmod" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for a uses of the "chsh" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "crontab" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "gpasswd" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "insmod" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "kmod" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "modprobe" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "newgrp" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "pam_timestamp_check" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "passwd" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "rm" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "rmmod" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "setfacl" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "ssh-agent" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "ssh-keysign" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "su" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "sudo" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "sudoedit" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "unix_chkpwd" or "unix2_chkpwd" commands.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "usermod" command.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "chmod", "fchmod" and "fchmodat" system calls.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "chown", "fchown", "fchownat", and "lchown" system calls.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "creat", "open", "openat", "open_by_handle_at", "truncate", and "ftruncate" system calls.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "delete_module" system call.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "init_module" and "finit_module" system calls.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "mount" system call.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all uses of the "umount" system call.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all modifications to the "lastlog" file.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all modifications to the "tallylog" file must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of "setfiles" in SLEM 5 must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of "semanage" in SLEM 5 must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of "setsebool" in SLEM 5 must generate an audit record.
1
Rule
Severity: High
The TippingPoint SMS must be configured to send log data to at least two central log servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).
1
Rule
Severity: Medium
Successful/unsuccessful uses of the "chage" command in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the "chcon" command in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the ssh-agent in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the "passwd" command in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of postdrop in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of postqueue in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of setsebool in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the ssh-keysign in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the "setfacl" command in RTOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the "pam_timestamp_check" command in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the "newgrp" command in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the "init_module" command in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the "rename" command in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the "renameat" command in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the "rmdir" command in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the "unlink" command in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the "unlinkat" command in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the "finit_module" command in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the "delete_module" command in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the "crontab" command in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the "chsh" command in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of setfiles in TOSS must generate an audit record.
1
Rule
Severity: Medium
Successful/unsuccessful uses of the "chacl" command in TOSS must generate an audit record.
1
Rule
Severity: Medium
The NSX Manager must configure logging levels for services to ensure audit records are generated.
Patternfly
PatternFly elements
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Modules