Capacity
19
27
Rule
Severity: Medium
Install the Host Intrusion Prevention System (HIPS) Module
7
Rule
Severity: Medium
Install the Asset Configuration Compliance Module (ACCM)
7
Rule
Severity: Medium
Install the Policy Auditor (PA) Module
35
Rule
Severity: Medium
Enable auditd Service
33
Rule
Severity: Medium
Make the auditd Configuration Immutable
33
Rule
Severity: Medium
Record Events that Modify the System's Mandatory Access Controls
33
Rule
Severity: Medium
Ensure auditd Collects Information on Exporting to Media (successful)
33
Rule
Severity: Medium
Record Events that Modify the System's Network Environment
33
Rule
Severity: Medium
Record Attempts to Alter Process and Session Initiation Information
33
Rule
Severity: Medium
Ensure auditd Collects System Administrator Actions
29
Rule
Severity: Medium
Record Events that Modify User/Group Information
30
Rule
Severity: Medium
System Audit Logs Must Have Mode 0750 or Less Permissive
43
Rule
Severity: Medium
System Audit Logs Must Be Owned By Root
32
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - chmod
32
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - chown
33
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fchmod
32
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fchmodat
32
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fchown
32
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fchownat
33
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fremovexattr
32
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fsetxattr
33
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - lchown
32
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - lremovexattr
32
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - lsetxattr
32
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - removexattr
32
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - setxattr
23
Rule
Severity: Medium
Ensure auditd Collects File Deletion Events by User
32
Rule
Severity: Medium
Ensure auditd Collects File Deletion Events by User - rename
32
Rule
Severity: Medium
Ensure auditd Collects File Deletion Events by User - renameat
32
Rule
Severity: Medium
Ensure auditd Collects File Deletion Events by User - rmdir
32
Rule
Severity: Medium
Ensure auditd Collects File Deletion Events by User - unlink
32
Rule
Severity: Medium
Ensure auditd Collects File Deletion Events by User - unlinkat
25
Rule
Severity: Medium
Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
26
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - creat
26
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - ftruncate
27
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - open
26
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - open_by_handle_at
26
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - openat
26
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - truncate
25
Rule
Severity: Medium
Ensure auditd Collects Information on Kernel Module Loading and Unloading
26
Rule
Severity: Medium
Ensure auditd Collects Information on Kernel Module Unloading - delete_module
27
Rule
Severity: Medium
Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
25
Rule
Severity: Medium
Ensure auditd Collects Information on Kernel Module Loading - init_module
32
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands
33
Rule
Severity: Medium
Record attempts to alter time through adjtimex
33
Rule
Severity: Medium
Record Attempts to Alter Time Through clock_settime
32
Rule
Severity: Medium
Record attempts to alter time through settimeofday
32
Rule
Severity: Medium
Record Attempts to Alter Time Through stime
32
Rule
Severity: Medium
Record Attempts to Alter the localtime File
21
Rule
Severity: Low
Enable Auditing for Processes Which Start Prior to the Audit Daemon
31
Rule
Severity: Medium
Configure auditd to use audispd's syslog plugin
63
Rule
Severity: Medium
Configure auditd Disk Error Action on Disk Error
64
Rule
Severity: Medium
Configure auditd Disk Full Action when Disk Space Is Full
30
Rule
Severity: Medium
Configure auditd mail_acct Action on Low Disk Space
32
Rule
Severity: Medium
Configure auditd admin_space_left Action on Low Disk Space
29
Rule
Severity: Medium
Configure auditd Max Log File Size
59
Rule
Severity: Medium
Configure auditd max_log_file_action Upon Reaching Maximum Log Size
28
Rule
Severity: Medium
Configure auditd Number of Logs Retained
33
Rule
Severity: Medium
Configure auditd space_left Action on Low Disk Space
25
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/group
24
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/gshadow
25
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/security/opasswd
25
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/passwd
25
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/shadow
19
Rule
Severity: Medium
System Audit Logs Must Have Mode 0640 or Less Permissive
13
Rule
Severity: Medium
Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
13
Rule
Severity: Medium
Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
13
Rule
Severity: Medium
Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
13
Rule
Severity: Medium
Record Unsuccessful Creation Attempts to Files - open O_CREAT
13
Rule
Severity: Medium
Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
13
Rule
Severity: Medium
Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
13
Rule
Severity: Medium
Record Unsuccessful Creation Attempts to Files - openat O_CREAT
13
Rule
Severity: Medium
Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
13
Rule
Severity: Medium
Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
16
Rule
Severity: Medium
Record Unsuccessful Delete Attempts to Files - rename
15
Rule
Severity: Medium
Record Unsuccessful Delete Attempts to Files - renameat
15
Rule
Severity: Medium
Record Unsuccessful Delete Attempts to Files - unlink
15
Rule
Severity: Medium
Record Unsuccessful Delete Attempts to Files - unlinkat
19
Rule
Severity: Medium
Record Attempts to Alter Logon and Logout Events
24
Rule
Severity: Medium
Record Attempts to Alter Logon and Logout Events - faillock
27
Rule
Severity: Medium
Record Attempts to Alter Logon and Logout Events - lastlog
23
Rule
Severity: Medium
Record Attempts to Alter Logon and Logout Events - tallylog
15
Rule
Severity: Medium
Configure auditd admin_space_left on Low Disk Space
34
Rule
Severity: Medium
Configure auditd space_left on Low Disk Space
8
Rule
Severity: Medium
System Audit Directories Must Be Group Owned By Root
8
Rule
Severity: Medium
System Audit Directories Must Be Owned By Root
13
Rule
Severity: Medium
System Audit Logs Must Be Group Owned By Root
1
Rule
Severity: Medium
The Kubernetes Audit Logs Directory Must Have Mode 0700
1
Rule
Severity: Medium
The OAuth Audit Logs Directory Must Have Mode 0700
1
Rule
Severity: Medium
The OpenShift Audit Logs Directory Must Have Mode 0700
1
Rule
Severity: Medium
Kubernetes Audit Logs Must Be Owned By Root
1
Rule
Severity: Medium
OAuth Audit Logs Must Be Owned By Root
1
Rule
Severity: Medium
OpenShift Audit Logs Must Be Owned By Root
1
Rule
Severity: Medium
Kubernetes Audit Logs Must Have Mode 0600
1
Rule
Severity: Medium
OAuth Audit Logs Must Have Mode 0600
1
Rule
Severity: Medium
OpenShift Audit Logs Must Have Mode 0600
1
Rule
Severity: Medium
Enable Auditing for Processes Which Start Prior to the Audit Daemon
Patternfly
PatternFly elements
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Modules