Capacity
CCI-002130
Automatically audit account enabling actions.
1
Rule
Severity: High
Enable audit Service
29
Rule
Severity: Medium
Record Events that Modify User/Group Information
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/group
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/gshadow
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/security/opasswd
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/passwd
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/shadow
8
Rule
Severity: Medium
Ensure auditd Collects System Administrator Actions - /etc/sudoers
7
Rule
Severity: Medium
Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/
2
Rule
Severity: Medium
AAA Services must be configured to automatically audit account enabling actions.
1
Rule
Severity: Medium
Compliance Guardian must provide automated mechanisms for supporting account management functions.
1
Rule
Severity: Medium
The Akamai Luna Portal must automatically audit account enabling actions.
2
Rule
Severity: Medium
The Arista network device must be configured to audit all administrator activity.
2
Rule
Severity: Medium
The application must automatically audit account enabling actions.
1
Rule
Severity: Medium
The DBN-6300 must automatically audit account enabling actions.
1
Rule
Severity: Medium
The HP FlexFabric Switch must automatically audit account enabling actions.
1
Rule
Severity: Medium
The HYCU server must initiate session auditing upon startup and produce audit log records containing sufficient information to establish what type of event occurred.
1
Rule
Severity: Medium
The DataPower Gateway must automatically audit account enabling actions.
1
Rule
Severity: Medium
The MQ Appliance network device must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
1
Rule
Severity: Medium
The MQ Appliance network device must generate account activity alerts that are forwarded to the administrators and Information System Security Officer (ISSO). Activity includes, creation, removal, modification and re-enablement after being previously disabled.
2
Rule
Severity: Medium
The Juniper router must be configured to automatically audit account enabling actions.
2
Rule
Severity: Medium
The Juniper SRX Services Gateway must automatically generate a log event when accounts are enabled.
2
Rule
Severity: Medium
The Mainframe Product must automatically audit account enabling actions.
2
Rule
Severity: Medium
ONTAP must automatically audit account-enabling actions.
2
Rule
Severity: Medium
The network device must automatically audit account enabling actions.
1
Rule
Severity: Medium
Nutanix AOS must audit all account actions.
1
Rule
Severity: High
Innoslate must use multifactor authentication for network access to privileged and non-privileged accounts.
1
Rule
Severity: High
The TippingPoint SMS must automatically generate audit records for account changes and actions with containing information needed for analysis of the event that occurred on the SMS and TPS.
2
Rule
Severity: Medium
The UEM server must automatically audit account-enabling actions.
1
Rule
Severity: Medium
The macOS system must initiate session audits at system startup, using internal clocks with time stamps for audit records that meet a minimum granularity of one second and can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT), in order to generate audit records containing information to establish what type of events occurred, the identity of any individual or process associated with the event, including individual identities of group account users, establish where the events occurred, source of the event, and outcome of the events including all account enabling actions, full-text recording of privileged commands, and information about the use of encryption for access wireless access to and from the system.
3
Rule
Severity: Medium
The macOS system must produce audit records containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions.
2
Rule
Severity: Medium
The macOS system must enable security auditing.
3
Rule
Severity: Medium
The Ubuntu operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
3
Rule
Severity: Medium
The Ubuntu operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
3
Rule
Severity: Medium
The Ubuntu operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
3
Rule
Severity: Medium
The Ubuntu operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
1
Rule
Severity: Medium
The Ubuntu operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
2
Rule
Severity: Medium
The Ubuntu operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
4
Rule
Severity: Medium
The Cisco router must be configured to automatically audit account enabling actions.
6
Rule
Severity: Medium
The Cisco switch must be configured to automatically audit account enabling actions.
2
Rule
Severity: Low
The Cisco ISE must automatically audit account enabling actions.
2
Rule
Severity: Medium
The container platform must automatically audit account-enabling actions.
2
Rule
Severity: Medium
The operating system must audit all account enabling actions.
2
Rule
Severity: Medium
AIX must provide audit record generation functionality for DoD-defined auditable events.
2
Rule
Severity: Medium
IBM z/OS Required SMF data record types must be collected.
4
Rule
Severity: Medium
IBM z/OS required SMF data record types must be collected.
2
Rule
Severity: Medium
The ICS must be configured to audit the execution of privileged functions such as accounts additions and changes.
2
Rule
Severity: Medium
The system must be configured to audit Account Management - Security Group Management successes.
2
Rule
Severity: Medium
The system must be configured to audit Account Management - User Account Management failures.
2
Rule
Severity: Medium
The system must be configured to audit Account Management - User Account Management successes.
2
Rule
Severity: Medium
Windows Server 2016 must be configured to audit Account Management - Security Group Management successes.
2
Rule
Severity: Medium
Windows Server 2016 must be configured to audit Account Management - User Account Management successes.
2
Rule
Severity: Medium
Windows Server 2016 must be configured to audit Account Management - User Account Management failures.
2
Rule
Severity: Medium
Windows Server 2016 must be configured to audit Account Management - Computer Account Management successes.
2
Rule
Severity: Medium
Windows Server 2019 must be configured to audit Account Management - Security Group Management successes.
2
Rule
Severity: Medium
Windows Server 2019 must be configured to audit Account Management - User Account Management successes.
2
Rule
Severity: Medium
Windows Server 2019 must be configured to audit Account Management - User Account Management failures.
2
Rule
Severity: Medium
Windows Server 2019 must be configured to audit Account Management - Computer Account Management successes.
2
Rule
Severity: Medium
Windows Server 2022 must be configured to audit Account Management - Security Group Management successes.
2
Rule
Severity: Medium
Windows Server 2022 must be configured to audit Account Management - User Account Management successes.
2
Rule
Severity: Medium
Windows Server 2022 must be configured to audit Account Management - User Account Management failures.
2
Rule
Severity: Medium
Windows Server 2022 must be configured to audit Account Management - Computer Account Management successes.
2
Rule
Severity: Medium
The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/shadow".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/security/opasswd".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/passwd".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/gshadow".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/group".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/".
2
Rule
Severity: Medium
Rancher RKE2 components must be configured in accordance with the security configuration settings based on DOD security configuration or implementation guidance, including SRGs, STIGs, NSA configuration guides, CTOs, and DTMs.
2
Rule
Severity: Medium
OpenShift must generate audit rules to capture account related actions.
1
Rule
Severity: Medium
The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
1
Rule
Severity: Medium
The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
1
Rule
Severity: Medium
The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
1
Rule
Severity: Medium
The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
1
Rule
Severity: Medium
The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
2
Rule
Severity: Medium
The VMM must automatically audit account enabling actions.
4
Rule
Severity: Medium
The Photon operating system must audit all account modifications.
1
Rule
Severity: Medium
The BIG-IP appliance must be configured to automatically audit account-enabling actions.
1
Rule
Severity: Medium
The macOS system must be configured to audit all administrative action events.
1
Rule
Severity: Medium
Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
1
Rule
Severity: Medium
Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
1
Rule
Severity: Medium
Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
1
Rule
Severity: Medium
Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
1
Rule
Severity: Medium
Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
1
Rule
Severity: Medium
The F5 BIG-IP appliance must be configured to audit the execution of privileged functions such as accounts additions and changes.
1
Rule
Severity: Medium
MKE must be configured to integrate with an Enterprise Identity Provider.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
1
Rule
Severity: High
The TippingPoint SMS must be configured to send log data to at least two central log servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).
1
Rule
Severity: Medium
TOSS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
1
Rule
Severity: Medium
TOSS must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group".
1
Rule
Severity: Medium
TOSS must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow".
1
Rule
Severity: Medium
TOSS must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd".
1
Rule
Severity: Medium
TOSS must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd".
1
Rule
Severity: Medium
TOSS must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
1
Rule
Severity: Medium
TOSS must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/".
Patternfly
PatternFly elements
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Modules