CCI-001684

The information system notifies organization-defined personnel or roles for account modification actions.

6 rules found Severity: Medium

1 rule found Severity: Medium

1 rule found Severity: Low

1 rule found Severity: High

2 rules found Severity: Medium

1 rule found Severity: Medium

1 rule found Severity: Low

1 rule found Severity: Medium

1 rule found Severity: Low

1 rule found Severity: Medium

1 rule found Severity: Low

1 rule found Severity: Medium

3 rules found Severity: Medium

CCI-001684

Record Events that Modify User/Group Information - /etc/group

Record Events that Modify User/Group Information - /etc/gshadow

Record Events that Modify User/Group Information - /etc/security/opasswd

Record Events that Modify User/Group Information - /etc/passwd

Record Events that Modify User/Group Information - /etc/shadow

The A10 Networks ADC must generate alerts to the administrators and ISSO when accounts are modified.

Compliance Guardian must provide automated mechanisms for supporting account management functions.

The Akamai Luna Portal must generate alerts that can be forwarded to the SAs and ISSO when accounts are modified.

The DataPower Gateway must generate alerts that can be forwarded to the administrators and ISSO when accounts are modified.

The MQ Appliance network device must generate account activity alerts that are forwarded to the administrators and Information System Security Officer (ISSO). Activity includes, creation, removal, modification and re-enablement after being previously disabled.

Riverbed Optimization System (RiOS) must generate alerts that can be forwarded to the administrators and ISSO when accounts are modified.

Innoslate must use multifactor authentication for network access to privileged and non-privileged accounts.

Tanium must notify system administrators and ISSO when accounts are modified.

Tanium must notify SA and ISSO when accounts are modified.

The Tanium Operating System (TanOS) must audit and notify system administrators and ISSOs when accounts are modified.

The BIG-IP appliance must be configured to generate alerts that can be forwarded to the administrators and Information System Security Officer (ISSO) when accounts are modified.

MKE must be configured to integrate with an Enterprise Identity Provider.

SLEM 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.

Splunk Enterprise must notify the system administrator (SA) and information system security officer (ISSO) when account events are received (creation, deletion, modification, disabling).

Splunk Enterprise must notify analysts of applicable events for Tier 2 CSSP and JRSS only.

Splunk Enterprise must notify the system administrator (SA) and information system security officer (ISSO) when account events are received (creation, deletion, modification, or disabling).

The Tanium Operating System (TanOS) must audit and notify system administrators (SAs) and information system security officers (ISSOs) when accounts are modified.

Tanium must notify system administrators (SAs) and the information system security officer (ISSO) when accounts are modified.

Tanium must notify system administrators and the information system security officer (ISSO) when accounts are modified.

The application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are modified.

The Dragos Platform must notify system administrators and information system security officer (ISSO) of local account activity.

The Juniper SRX Services Gateway must allow only the information system security manager (ISSM) (or administrators/roles appointed by the ISSM) to select which auditable events are to be generated and forwarded to the syslog and/or local logs.

Access to Prisma Cloud Compute must be managed based on user need and least privileged using external identity providers for authentication and grouping to role-based assignments when possible.

OpenShift must generate audit rules to capture account related actions.

RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.

The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.

The ESXi host must offload logs via syslog.

The ESXi host must off-load logs via syslog.

The vCenter Server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, on every Single Sign-On (SSO) account action.