CCI-002884
Log organization-defined audit events for nonlocal maintenance and diagnostic sessions.
34 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
34 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
34 rules found Severity: Medium
33 rules found Severity: Medium
34 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
33 rules found Severity: Medium
31 rules found Severity: Medium
33 rules found Severity: Medium
25 rules found Severity: Medium
27 rules found Severity: Medium
28 rules found Severity: Medium
26 rules found Severity: Medium
7 rules found Severity: Medium
26 rules found Severity: Medium
13 rules found Severity: Medium
13 rules found Severity: Medium
13 rules found Severity: Medium
13 rules found Severity: Medium
13 rules found Severity: Medium
13 rules found Severity: Medium
13 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
13 rules found Severity: Medium
20 rules found Severity: Medium
13 rules found Severity: Medium
18 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
18 rules found Severity: Medium
18 rules found Severity: Medium
12 rules found Severity: Medium
13 rules found Severity: Medium
20 rules found Severity: Medium
20 rules found Severity: Medium
23 rules found Severity: Medium
19 rules found Severity: Medium
19 rules found Severity: Medium
20 rules found Severity: Medium
16 rules found Severity: Medium
10 rules found Severity: Medium
10 rules found Severity: Medium
18 rules found Severity: Medium
2 rules found Severity: Medium
5 rules found Severity: Medium
2 rules found Severity: Medium
3 rules found Severity: Medium
Nutanix AOS must audit all activities performed during nonlocal maintenance and diagnostic sessions.
1 rule found Severity: Medium
The macOS system must generate audit records for all account creations, modifications, disabling, and termination events; privileged activities or other system-level access; all kernel module load, unload, and restart actions; all program initiations; and organizationally defined events for all non-local maintenance and diagnostic sessions.
1 rule found Severity: Medium
The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
1 rule found Severity: Medium
The Red Hat Enterprise Linux operating system must audit all uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate syscalls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The Red Hat Enterprise Linux operating system must generate audit records for all unsuccessful account access events.
1 rule found Severity: Medium
The Red Hat Enterprise Linux operating system must generate audit records for all successful account access events.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The Red Hat Enterprise Linux operating system must audit all uses of the sudoers file and all files in the /etc/sudoers.d/ directory.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The Red Hat Enterprise Linux operating system must audit all uses of the unlink, unlinkat, rename, renameat, and rmdir syscalls.
1 rule found Severity: Medium
The macOS system must generate audit records for all account creations, modifications, disabling, and termination events; privileged activities or other system-level access; all kernel module load, unload, and restart actions; all program initiations; and organizationally defined events for all nonlocal maintenance and diagnostic sessions.
1 rule found Severity: Medium
The Ubuntu operating system must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions and other system-level access.
1 rule found Severity: Medium
SSMC must provide audit record generation capability for DOD-defined auditable events for all operating system components.
1 rule found Severity: Low
1 rule found Severity: Medium
The Oracle Linux operating system must audit all uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate syscalls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The Oracle Linux operating system must generate audit records for all unsuccessful account access events.
1 rule found Severity: Medium
The Oracle Linux operating system must generate audit records for all successful account access events.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Oracle Linux operating system must audit all uses of the unlink, unlinkat, rename, renameat, and rmdir syscalls.
1 rule found Severity: Medium
SLEM 5 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
SLEM 5 must generate audit records for all uses of the "chmod", "fchmod" and "fchmodat" system calls.
1 rule found Severity: Medium
SLEM 5 must generate audit records for all uses of the "chown", "fchown", "fchownat", and "lchown" system calls.
1 rule found Severity: Medium
SLEM 5 must generate audit records for all uses of the "creat", "open", "openat", "open_by_handle_at", "truncate", and "ftruncate" system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
SLEM 5 must generate audit records for all uses of the "init_module" and "finit_module" system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
SLEM 5 must generate audit records for all uses of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
SLEM 5 must generate audit records for all modifications to the "tallylog" file must generate an audit record.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Successful/unsuccessful uses of the "pam_timestamp_check" command in TOSS must generate an audit record.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Applications used for non-local maintenance sessions must audit non-local maintenance and diagnostic sessions for organization-defined auditable events.
1 rule found Severity: Medium
Ubuntu 22.04 LTS must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions and other system-level access.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect the files within /etc/sudoers.d/
1 rule found Severity: Medium
The container platform must audit non-local maintenance and diagnostic sessions' organization-defined audit events associated with non-local maintenance.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/tallylog.
1 rule found Severity: Medium
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Successful/unsuccessful uses of the umount2 system call in AlmaLinux OS 9 must generate an audit record.
1 rule found Severity: Medium
1 rule found Severity: Medium
AlmaLinux OS 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
AlmaLinux OS 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
AlmaLinux OS 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
1 rule found Severity: Medium
The operating system must audit all activities performed during nonlocal maintenance and diagnostic sessions.
1 rule found Severity: Medium
IBM z/OS SMF recording options for the FTP Server must be configured to write SMF records for all eligible events.
2 rules found Severity: Medium
IBM z/OS SMF recording options for the SSH daemon must be configured to write SMF records for all eligible events.
3 rules found Severity: Medium
2 rules found Severity: Medium
IBM z/OS SMF recording options for the FTP server must be configured to write SMF records for all eligible events.
1 rule found Severity: Medium
1 rule found Severity: Medium
Mainframe Products must audit nonlocal maintenance and diagnostic sessions audit events as defined in site security plan.
1 rule found Severity: Medium
OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
1 rule found Severity: Medium
Rancher RKE2 components must be configured in accordance with the security configuration settings based on DOD security configuration or implementation guidance, including SRGs, STIGs, NSA configuration guides, CTOs, and DTMs.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/security/opasswd".
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
1 rule found Severity: Medium
OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/".
1 rule found Severity: Medium
The OL 8 audit system must be configured to audit any use of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
OL 8 must generate audit records for any use of the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
OL 8 must generate audit records for any use of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls.
1 rule found Severity: Medium
OL 8 must generate audit records for any use of the "chown", "fchown", "fchownat", and "lchown" system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
OL 8 must allocate an "audit_backlog_limit" of sufficient size to capture processes that start prior to the audit daemon.
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Medium
RHEL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
RHEL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
SUSE operating system audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Low
2 rules found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Low
2 rules found Severity: Low
2 rules found Severity: Low
2 rules found Severity: Medium
The SUSE operating system must generate audit records for all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr syscalls.
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the chown, fchown, fchownat, and lchown syscalls.
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the chmod, fchmod, and fchmodat system calls.
2 rules found Severity: Medium
The SUSE operating system must generate audit records for all uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate syscalls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.
1 rule found Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/tallylog.
1 rule found Severity: Medium
1 rule found Severity: Low
2 rules found Severity: Low
2 rules found Severity: Low
2 rules found Severity: Low
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
Successful/unsuccessful attempts to modify categories of information (e.g., classification levels) must generate audit records.
1 rule found Severity: Medium
2 rules found Severity: Medium
The SUSE operating system must generate audit records for all modifications to the tallylog file must generate an audit record.
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
The SUSE operating system must generate audit records for all uses of the pam_timestamp_check command.
2 rules found Severity: Medium
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the init_module and finit_module syscalls.
1 rule found Severity: Medium
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the unlink, unlinkat, rename, renameat and rmdir syscalls.
1 rule found Severity: Medium
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the unix_chkpwd or unix2_chkpwd commands.
1 rule found Severity: Medium
The SUSE operating system must audit all uses of the sudoers file and all files in the /etc/sudoers.d/ directory.
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate system calls.
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the chown, fchown, fchownat, and lchown system calls.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the delete_module system call.
1 rule found Severity: Medium
The SUSE operating system must generate audit records for all uses of the init_module and finit_module system calls.
1 rule found Severity: Medium