CCI-000169
Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
34 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
34 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
34 rules found Severity: Medium
33 rules found Severity: Medium
34 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
31 rules found Severity: Medium
33 rules found Severity: Medium
27 rules found Severity: Medium
28 rules found Severity: Medium
26 rules found Severity: Medium
7 rules found Severity: Medium
26 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
13 rules found Severity: Medium
20 rules found Severity: Medium
13 rules found Severity: Medium
18 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
18 rules found Severity: Medium
18 rules found Severity: Medium
13 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
23 rules found Severity: Medium
19 rules found Severity: Medium
19 rules found Severity: Medium
20 rules found Severity: Medium
16 rules found Severity: Medium
10 rules found Severity: Medium
10 rules found Severity: Medium
18 rules found Severity: Medium
2 rules found Severity: Medium
5 rules found Severity: Medium
2 rules found Severity: Medium
3 rules found Severity: Medium
The Akamai Luna Portal must provide audit record generation capability for DoD-defined auditable events within the network device.
1 rule found Severity: Low
1 rule found Severity: Medium
The DBN-6300 must provide audit record generation capability for DoD-defined auditable events within the DBN-6300.
1 rule found Severity: Medium
The audit log configuration level must be set to request in the Universal Control Plane (UCP) component of Docker Enterprise.
1 rule found Severity: Medium
The host operating systems auditing policies for the Docker Engine - Enterprise component of Docker Enterprise must be set.
1 rule found Severity: Medium
1 rule found Severity: Medium
Google Android 12 must be configured to generate audit records for the following auditable events: detected integrity violations.
2 rules found Severity: Medium
The HP FlexFabric Switch must provide audit record generation capability for DoD-defined auditable events within the HP FlexFabric Switch.
1 rule found Severity: Low
1 rule found Severity: Medium
The DataPower Gateway must provide audit record generation capability for DoD-defined auditable events within DataPower.
1 rule found Severity: Medium
DB2 must provide audit record generation capability for DoD-defined auditable events within all DBMS/database components.
1 rule found Severity: Medium
1 rule found Severity: Medium
The MaaS360 MDM server must be configured to enable all required audit events (if function is not automatically implemented during MDM/MAS server install): a. Failure to push a new application on a managed mobile device.
1 rule found Severity: Low
The MaaS360 server must be configured to enable all required audit events (if function is not automatically implemented during MDM/MAS server install): b. Failure to update an existing application on a managed mobile device.
1 rule found Severity: Low
The MaaS360 MDM Agent must be configured to implement the management setting: periodicity of reachability events equals six hours or less.
1 rule found Severity: Medium
1 rule found Severity: Medium
Microsoft Android 11 must be configured to generate audit records for the following auditable events: Detected integrity violations.
2 rules found Severity: Medium
Motorola Solutions Android 11 must be configured to generate audit records for the following auditable events: Detected integrity violations.
1 rule found Severity: Low
2 rules found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Nutanix AOS must provide audit record generation capability for DoD-defined auditable events for successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels).
1 rule found Severity: Medium
Nutanix AOS must provide audit record generation capability for DoD-defined auditable events for system and account management actions.
1 rule found Severity: Medium
Nutanix AOS must provide audit record generation capability for DoD-defined auditable events for file attribute management actions.
1 rule found Severity: Medium
Nutanix AOS must provide audit record generation capability for DoD-defined auditable events for system module management actions.
1 rule found Severity: Medium
Nutanix AOS must provide audit record generation capability for DoD-defined auditable events for directory and permissions management actions.
1 rule found Severity: Medium
Nutanix AOS must provide audit record generation capability for DoD-defined auditable events for file management actions.
1 rule found Severity: Medium
Nutanix AOS must provide audit record generation capability for DoD-defined auditable events for all account creations, modifications, disabling, and terminations.
1 rule found Severity: Medium
1 rule found Severity: Medium
OHS must have the client requests logging module loaded to generate log records for system startup and shutdown, system access, and system authentication logging.
1 rule found Severity: Medium
OHS must have OraLogMode set to Oracle Diagnostic Logging text mode to generate log records for system startup and shutdown, system access, and system authentication logging.
1 rule found Severity: Medium
OHS must have a log directory location defined to generate log records for system startup and shutdown, system access, and system authentication logging.
1 rule found Severity: Medium
OHS must have a log level severity defined to generate adequate log records for system startup and shutdown, system access, and system authentication events.
1 rule found Severity: Medium
OHS must have the log rotation parameter set to allow for the generation log records for system startup and shutdown, system access, and system authentication events.
1 rule found Severity: Medium
OHS must have a log format defined to generate adequate logs by system startup and shutdown, system access, and system authentication events.
1 rule found Severity: Medium
OHS must have a SSL log format defined to generate adequate logs by system startup and shutdown, system access, and system authentication events.
1 rule found Severity: Medium
OHS must have a log file defined for each site/virtual host to capture logs generated by system startup and shutdown, system access, and system authentication events.
1 rule found Severity: Medium
Riverbed Optimization System (RiOS) must provide audit record generation capability for DoD-defined auditable events within the network device.
1 rule found Severity: Medium
The Tanium operating system (TanOS) must offload audit records onto a different system or media than the system being audited.
2 rules found Severity: Medium
The NSX-T Manager must generate log records for the info level to capture the DoD-required auditable events.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
2 rules found Severity: Medium
The DBMS must provide audit record generation capability for organization-defined auditable events within the database.
2 rules found Severity: Medium
PostgreSQL must provide audit record generation capability for DoD-defined auditable events within all DBMS/database components.
1 rule found Severity: Medium
Zebra Android 11 must be configured to generate audit records for the following auditable events: Detected integrity violations.
1 rule found Severity: Low
The EDB Postgres Advanced Server must be configured to provide audit record generation capability for DoD-defined auditable events within all EDB Postgres Advanced Server/database components.
1 rule found Severity: Medium
1 rule found Severity: Medium
A BIND 9.x server implementation must be configured to allow DNS administrators to audit all DNS server components, based on selectable event criteria, and produce audit records within all DNS server components that contain information for failed security verification tests, information to establish the outcome and source of the events, any information necessary to determine cause of failure, and any information necessary to return to operations with least disruption to mission processes.
1 rule found Severity: Low
The BIND 9.x server logging configuration must be configured to generate audit records for all DoD-defined auditable events to a local file by enabling triggers for all events with a severity of info, notice, warning, error, and critical for all DNS components.
1 rule found Severity: Low
IDMS must use the ESM to generate auditable records for resources when DoD-defined auditable events occur.
1 rule found Severity: High
IDMS must use the ESM to generate auditable records for commands and utilities when DoD-defined auditable events occur.
1 rule found Severity: High
PostgreSQL must be configured to provide audit record generation for DoD-defined auditable events within all DBMS/database components.
1 rule found Severity: Medium
PostgreSQL must provide audit record generation capability for DOD-defined auditable events within all DBMS/database components.
1 rule found Severity: Medium
The Cisco ASA must be configured to log events based on policy access control rules, signatures, and anomaly analysis.
1 rule found Severity: Medium
The Cisco ASA must be configured to send log records to the syslog server for specific facility and severity level.
1 rule found Severity: Medium
1 rule found Severity: Medium
The DNS server implementation must be configured to provide audit record generation capability for DoD-defined auditable events within all DNS server components.
2 rules found Severity: Medium
The EDB Postgres Advanced Server must provide audit record generation capability for DOD-defined auditable events within all EDB Postgres Advanced Server/database components.
1 rule found Severity: Medium
The Enterprise Voice, Video, and Messaging Endpoint must be configured to provide session (call detail) record generation capability.
1 rule found Severity: Medium
The Enterprise Voice, Video, and Messaging Session Manager must produce session (call) records for events determined to be significant and relevant by local policy.
1 rule found Severity: Medium
The F5 BIG-IP appliance must be configured to audit the execution of privileged functions such as accounts additions and changes.
1 rule found Severity: Medium
SSMC must provide audit record generation capability for DOD-defined auditable events for all operating system components.
1 rule found Severity: Low
SSMC web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The JBoss server must generate log records for access and authentication events to the management interface.
1 rule found Severity: Medium
The Juniper EX switch must be configured to generate log records for a locally developed list of auditable events.
1 rule found Severity: Medium
MarkLogic Server must be configured to provide audit record generation capability for DoD-defined auditable events within all DBMS/database components.
1 rule found Severity: Medium
MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.
1 rule found Severity: Medium
The Azure SQL Database must be configured to generate audit records for DOD-defined auditable events within all DBMS/database components.
1 rule found Severity: Medium
1 rule found Severity: Medium
The MySQL Database Server 8.0 must be configured to provide audit record generation capability for DoD-defined auditable events within all database components.
1 rule found Severity: Medium
Redis Enterprise DBMS must provide audit record generation capability for DoD-defined auditable events within all DBMS/database components.
1 rule found Severity: Medium
Rancher MCM must generate audit records for all DoD-defined auditable events within all components in the platform.
1 rule found Severity: Medium
Redis Enterprise DBMS must generate audit records for DoD-defined auditable events within all DBMS/database components.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
SLEM 5 must generate audit records for all uses of the "chmod", "fchmod" and "fchmodat" system calls.
1 rule found Severity: Medium
SLEM 5 must generate audit records for all uses of the "chown", "fchown", "fchownat", and "lchown" system calls.
1 rule found Severity: Medium
SLEM 5 must generate audit records for all uses of the "creat", "open", "openat", "open_by_handle_at", "truncate", and "ftruncate" system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
SLEM 5 must generate audit records for all uses of the "init_module" and "finit_module" system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
SLEM 5 must generate audit records for all uses of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
SLEM 5 must generate audit records for all modifications to the "tallylog" file must generate an audit record.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Splunk Enterprise must be configured to retain the DoD-defined attributes of the log records sent by the devices and hosts.
1 rule found Severity: Medium
The TPS must provide audit record generation capability for detection events based on implementation of policy filters, rules, signatures, and anomaly analysis.
1 rule found Severity: Medium
The TPS must provide audit record generation capability for events where communication traffic is blocked or restricted based on policy filters, rules, signatures, and anomaly analysis.
1 rule found Severity: Medium
The TippingPoint SMS must be configured to send log data to at least two central log servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Successful/unsuccessful uses of the "pam_timestamp_check" command in TOSS must generate an audit record.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
2 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The application must provide audit record generation capability for HTTP headers including User-Agent, Referer, GET, and POST.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
1 rule found Severity: Medium
The Central Log Server must be configured to retain the DoD-defined attributes of the log records sent by the devices and hosts.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect the files within /etc/sudoers.d/
1 rule found Severity: Medium
The container platform must generate audit records for all DoD-defined auditable events within all components in the platform.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Successful/unsuccessful uses of the umount2 system call in AlmaLinux OS 9 must generate an audit record.
1 rule found Severity: Medium
1 rule found Severity: Medium
AlmaLinux OS 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
AlmaLinux OS 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
AlmaLinux OS 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
1 rule found Severity: Medium
The DBMS must provide audit record generation capability for DoD-defined auditable events within all DBMS/database components.
1 rule found Severity: Medium
1 rule found Severity: Medium
Google Android 13 must be configured to generate audit records for the following auditable events: Detected integrity violations.
2 rules found Severity: Medium
1 rule found Severity: Medium
Google Android 14 must be configured to generate audit records for the following auditable events: Detected integrity violations.
2 rules found Severity: Medium
Google Android 15 must be configured to generate audit records for the following auditable events: Detected integrity violations.
2 rules found Severity: Medium
The operating system must provide audit record generation capability for DoD-defined auditable events for all operating system components.
1 rule found Severity: Medium
1 rule found Severity: Medium
The HYCU virtual appliance must generate log records for a locally developed list of auditable events.
1 rule found Severity: Medium
The IDPS must provide audit record generation capability for detection events based on implementation of policy filters, rules, signatures, and anomaly analysis.
1 rule found Severity: Medium
The IDPS must provide audit record generation capability for events where communication traffic is blocked or restricted based on policy filters, rules, signatures, and anomaly analysis.
1 rule found Severity: Medium
The IDPS must provide audit record generation with a configurable severity and escalation level capability.
1 rule found Severity: Medium
The Juniper router must be configured to generate log records for a locally developed list of auditable events.
1 rule found Severity: Medium
The Juniper Networks SRX Series Gateway IDPS must provide audit record generation capability for detecting events based on implementation of policy filters, rules, and signatures.
1 rule found Severity: Medium
The Juniper Networks SRX Series Gateway IDPS must provide audit record generation with a configurable severity and escalation level capability.
1 rule found Severity: Medium
The Mainframe Product must provide audit record generation capability for DoD-defined auditable events within all application components.
1 rule found Severity: Medium
The Juniper SRX Services Gateway must automatically terminate a network administrator session after organization-defined conditions or trigger events requiring session disconnect.
1 rule found Severity: Medium
MariaDB must provide audit record generation capability for DoD-defined auditable events within all DBMS/database components.
1 rule found Severity: Medium
2 rules found Severity: Medium
SQL Server must be configured to generate audit records for DoD-defined auditable events within all DBMS/database components.
1 rule found Severity: Medium
Windows Server 2019 must force audit policy subcategory settings to override audit policy category settings.
1 rule found Severity: Medium
Windows Server 2022 must force audit policy subcategory settings to override audit policy category settings.
1 rule found Severity: Medium
OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
1 rule found Severity: Medium
OpenShift must generate audit records for all DOD-defined auditable events within all components in the platform.
1 rule found Severity: Medium
1 rule found Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/security/opasswd".
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
1 rule found Severity: Medium
OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/".
1 rule found Severity: Medium
The OL 8 audit system must be configured to audit any use of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
OL 8 must generate audit records for any use of the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
OL 8 must generate audit records for any use of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls.
1 rule found Severity: Medium
OL 8 must generate audit records for any use of the "chown", "fchown", "fchownat", and "lchown" system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
OL 8 must allocate an "audit_backlog_limit" of sufficient size to capture processes that start prior to the audit daemon.
1 rule found Severity: Low
1 rule found Severity: Low
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
1 rule found Severity: Medium
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
1 rule found Severity: Medium
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
1 rule found Severity: Medium
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
1 rule found Severity: Medium
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
1 rule found Severity: Medium
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
1 rule found Severity: Medium
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/.
1 rule found Severity: Medium
1 rule found Severity: Medium
The RHEL 8 audit system must be configured to audit any usage of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Successful/unsuccessful uses of the pam_timestamp_check command in RHEL 8 must generate an audit record.
1 rule found Severity: Medium
1 rule found Severity: Medium
Successful/unsuccessful uses of the init_module and finit_module system calls in RHEL 8 must generate an audit record.
1 rule found Severity: Medium
Successful/unsuccessful uses of the rename, unlink, rmdir, renameat, and unlinkat system calls in RHEL 8 must generate an audit record.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Successful/unsuccessful uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls in RHEL 8 must generate an audit record.
1 rule found Severity: Medium
Successful/unsuccessful uses of the chown, fchown, fchownat, and lchown system calls in RHEL 8 must generate an audit record.
1 rule found Severity: Medium
Successful/unsuccessful uses of the chmod, fchmod, and fchmodat system calls in RHEL 8 must generate an audit record.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Successful/unsuccessful modifications to the faillock log file in RHEL 8 must generate an audit record.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Low
RHEL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
RHEL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
RHEL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Low
2 rules found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Low
2 rules found Severity: Low
2 rules found Severity: Low
2 rules found Severity: Medium
The SUSE operating system must generate audit records for all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr syscalls.
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the chown, fchown, fchownat, and lchown syscalls.
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the chmod, fchmod, and fchmodat system calls.
2 rules found Severity: Medium
The SUSE operating system must generate audit records for all uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate syscalls.
1 rule found Severity: Medium
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.
1 rule found Severity: Medium
1 rule found Severity: Low
2 rules found Severity: Low
2 rules found Severity: Low
2 rules found Severity: Low
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
Successful/unsuccessful attempts to modify categories of information (e.g., classification levels) must generate audit records.
1 rule found Severity: Medium
2 rules found Severity: Medium
The SUSE operating system must generate audit records for all modifications to the tallylog file must generate an audit record.
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
The SUSE operating system must generate audit records for all uses of the pam_timestamp_check command.
2 rules found Severity: Medium
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the init_module and finit_module syscalls.
1 rule found Severity: Medium
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the unlink, unlinkat, rename, renameat and rmdir syscalls.
1 rule found Severity: Medium
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the unix_chkpwd or unix2_chkpwd commands.
1 rule found Severity: Medium
The SUSE operating system must audit all uses of the sudoers file and all files in the /etc/sudoers.d/ directory.
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate system calls.
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the chown, fchown, fchownat, and lchown system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the delete_module system call.
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the init_module and finit_module system calls.
1 rule found Severity: Medium
The audit records must provide data for all auditable events defined at the organizational level for the organization-defined information system components.
2 rules found Severity: Medium
The operating system must support the capability to compile audit records from multiple components within the system into a system-wide (logical or physical) audit trail that is time-correlated to within organization-defined level of tolerance.
2 rules found Severity: Medium
The audit system must be configured to audit all discretionary access control permission modifications.
2 rules found Severity: Medium
2 rules found Severity: Medium
The UEM Agent must provide an alert via the trusted channel to the UEM Server in the event of any of the following audit events: -successful application of policies to a mobile device -receiving or generating periodic reachability events -change in enrollment state -failure to install an application from the UEM Server -failure to update an application from the UEM Server.
1 rule found Severity: Medium
The UEM Agent must generate a UEM Agent audit record of the following auditable events:-startup and shutdown of the UEM Agent-UEM policy updated-any modification commanded by the UEM Server.
1 rule found Severity: Medium
The UEM Agent must be configured to enable the following function: read audit logs of the managed endpoint device.
1 rule found Severity: Medium
The VMM must provide audit record generation capability for DoD-defined auditable events for all VMM components.
1 rule found Severity: Medium
The UEM server must provide audit record generation capability for DoD-defined auditable events within all application components.
1 rule found Severity: Medium
The UEM server must be configured to provide audit records in a manner suitable for the Authorized Administrators to interpret the information.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The vCenter ESX Agent Manager service must produce log records containing sufficient information regarding event details.
2 rules found Severity: Medium
1 rule found Severity: Medium
The vCenter Lookup service must produce log records containing sufficient information regarding event details.
2 rules found Severity: Medium
The vCenter Perfcharts service must produce log records containing sufficient information regarding event details.
2 rules found Severity: Medium
1 rule found Severity: Medium
The vCenter PostgreSQL service must enable "pgaudit" to provide audit record generation capabilities.
2 rules found Severity: Medium
The vCenter STS service must produce log records containing sufficient information regarding event details.
2 rules found Severity: Medium
Zebra Android 13 must be configured to generate audit records for the following auditable events: Detected integrity violations.
2 rules found Severity: Medium
The vCenter UI service must produce log records containing sufficient information regarding event details.
2 rules found Severity: Medium